RE: modprobe error in log...

[McClure Gammon <gammon.mcclure () volvo com>]

Bob,
I ran into the same non-issue and it made me crazy/more crazy until I looked at the source code:  linux is searching 
for the module "reading from a file" which is set to prevent pcap from going bonkers when there's no interface defined, 
as when replaying a binary file.  It's an artifact and can be ignored.

HTH
Gammon

-----Original Message-----
From: Bob Hillegas [mailto:bobhillegas () pdq net]
Sent: Monday, May 13, 2002 9:37 AM
To: Matt Kettler
Cc: snort-users () lists sourceforge net
Subject: Re: [Snort-users] modprobe error in log...


Sorry for the lack of detail. Thanks for responding anyway.
Pentium processor
kernel 2.4.9-31
tcpdump 3.6.2-10.7
snort 1.8.6 (build 105)
iptables 1.2.5-3
ppp-2.4.0-2

I have a processor connecting to the 'net by extrnal modem dial-up using pppd. I 
capture ALL packets to log files. After the conection is terminated and the log 
file complete, I issue the command:
snort -r log.file -u snort -g snort -c snort.conf

Since the modem is offline, and I'm dealing with a static tcpdump output file at
that point, this simplifies the possible interactions a bit. I always get the
incomplete error message logged: 
modprobe: modprobe: Can't locate module [reading from a

What modules does snort depend on? I currently have loaded:

Module                  Size  Used by    Tainted: P  
ip_nat_ftp              3488   0  (unused)
ip_conntrack_ftp        3808   0  (unused)
ppp_deflate            39104   0  (autoclean)
bsd_comp                4224   0  (autoclean)
ppp_async               6848   0  (autoclean)
ppp_generic            19336   1  (autoclean) [ppp_deflate bsd_comp ppp_async]
slhc                    5056   1  (autoclean) [ppp_generic]
autofs                 11300   1  (autoclean)
eepro100               17040   1  (autoclean)
ipt_REJECT              3392   1  (autoclean)
ipt_multiport           1152   5  (autoclean)
ipt_LOG                 3872  22  (autoclean)
ipt_limit               1376  22  (autoclean)
ipt_state               1024  21  (autoclean)
iptable_mangle          2176   0  (autoclean) (unused)
ipt_MASQUERADE          1664   0  (autoclean)
ipt_REDIRECT            1152   1  (autoclean)
iptable_nat            16724   1  (autoclean) [ip_nat_ftp ipt_MASQUERADE ipt_REDIRECT]
ip_conntrack           15980   3  (autoclean) [ip_nat_ftp ip_conntrack_ftp ipt_state ipt_MASQUERADE ipt_REDIRECT 
iptable_nat]
iptable_filter          2144   0  (autoclean) (unused)
ip_tables              10976  12  [ipt_REJECT ipt_multiport ipt_LOG ipt_limit ipt_state iptable_mangle ipt_MASQUERADE 
ipt_REDIRECT iptable_nat iptable_filter]
st                     25972   0  (unused)
usb-uhci               20708   0  (unused)
usbcore                49920   1  [usb-uhci]
sym53c8xx              55428   8 
sd_mod                 11964   8 
scsi_mod               94616   3  [st sym53c8xx sd_mod]


Thanks, BobH
-- 
-------------------------------------------------
Bob Hillegas           
<bobhillegas () pdq net> 

On Sat, 11 May 2002, Matt Kettler wrote:

  > Date: Sat, 11 May 2002 12:01:54 -0400
  > From: Matt Kettler <mkettler () evi-inc com>
  > To: Bob Hillegas <bobhillegas () pdq net>, snort-users () lists sourceforge net
  > Subject: Re: [Snort-users] modprobe error in log...
  > 
  > Ok, can you be a bit less vague about your setup? it's hard to debug system 
  > configuration problems without knowing what kind of system you have. It 
  > sounds like one or more of your network interfaces don't have proper Linux 
  > drivers, but that's an educated guess at this point.
  > 
  > Based on the problem being reported I assume you are running Linux. What 
  > distro? what release?
  > 
  > What kind of network adapter is snort listening on?
  > 
  > Do *all* of your network interfaces work normally? do you have drivers for 
  > all of them? Are you using a custom kernel? what libpcap do you have (ie: 
  > do you have a broken redhat libpcap or a real one?)
  > 
  > 
  > At 10:33 PM 5/10/2002 -0500, Bob Hillegas wrote:
  > >Every time I execute:
  > >snort -r log.file -u snort -g snort -c snort.conf
  > >I get an entry in syslog that states:
  > >modprobe: modprobe: Can't locate module [reading from a
  > >That's all I get. Any ideas what is needed?
  > >BTW, the output shows all records read and 0 records logged. But it does 
  > >run to
  > >completion with no apparent errors except for the log entry.
  > >
  > >Thanks, BobH
  > 



_______________________________________________________________

Have big pipes? SourceForge.net is looking for download mirrors. We supply
the hardware. You get the recognition. Email Us: bandwidth () sourceforge net
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

_______________________________________________________________

Have big pipes? SourceForge.net is looking for download mirrors. We supply
the hardware. You get the recognition. Email Us: bandwidth () sourceforge net
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users