Snort mailing list archives
Re: OpenPcap() error
From: Robert Cole <robert.cole () support4linux com>
Date: Tue, 18 Mar 2003 10:30:50 -0800
snort -c /etc/snort/snort.conf
Close here's the first attempt: Mar 18 10:21:13 logger device eth0 entered promiscuous mode Mar 18 10:21:13 logger snort: WARNING: OpenPcap() device eth0 network lookup: eth0: no IPv4 address assigned Mar 18 10:21:13 logger snort: ERROR snort(10) => Group "(null)" unknown Mar 18 10:21:13 logger device eth0 left promiscuous mode I then edited the /etc/snort/snort.conf file to comment out the set_uid and set_gid I'm going to try the numbers next to see if that works. If not are these config params broken in 1.9.1? Then I got: Mar 18 10:22:17 logger device eth0 entered promiscuous mode Mar 18 10:22:17 logger snort: WARNING: OpenPcap() device eth0 network lookup: eth0: no IPv4 address assigned Mar 18 10:22:17 logger snort: FATAL ERROR: ERROR /etc/snort/snort.conf:19 => Port value missing in rule! Mar 18 10:22:17 logger device eth0 left promiscuous mode What do you suppose is wrong with: log udp 192.168.0.12/32 -> 192.168.0.111/32 514 (logto:"ws1.log";) ?? I checked the manual on this and page 9 of the 1.9.1 manual shows the port number that way. The rest seems ok to me. Any ideas? Thanks ------------------------------------------------------- This SF.net email is sponsored by: Does your code think in ink? You could win a Tablet PC. Get a free Tablet PC hat just for playing. What are you waiting for? http://ads.sourceforge.net/cgi-bin/redirect.pl?micr5043en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- OpenPcap() error Robert Cole (Mar 17)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Phil Wood (Mar 19)
- Re: OpenPcap() error Robert Cole (Mar 19)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)