RE: snort died for no reason

["Patrick Harper" <patrick () internetsecurityguru com>]

How about upgrading snort?  It is good to keep up and ISM supports 2.0 and
higher according to the support site. 

The Sourcefire ISM Agent currently supports Red Hat Linux versions 7.2, 8.0,
and 9 running Snort 2.0 or higher.  What was the last update you did on the
OS?  Did you recently upgrade the kernel or libpcap?  If you upgraded either
(or other things too) then you might be having a problem with the RPM
install of 2.1.3.  I would go to 2.4


-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of Wayne Ho
Sent: Wednesday, September 07, 2005 2:59 PM
To: snort-users () lists sourceforge net
Subject: [Snort-users] snort died for no reason

Dear all:

Recently Snort engine just die for no reason. When I
monitor /var/log/messages, it didn't indicate any
error. In addition, when I run tcpdump -i eth1 to
check the span port, tcpdump capture some packets, and
then froze, when I hit ctrl-C, I got lot of packets
dropped. I am using Snort 2.1.3 RPM, and with RH9.0.
Upgrade is not an option for me because the Sourcefire
ISM is running on it and this is the only version they
support.

Please advise.
Wayne






-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users