Snort mailing list archives
OpenPcap()
From: Gentoo-Wally <gentoowally () gmail com>
Date: Tue, 20 Jun 2006 11:27:59 -0400
I've started looking at snort 2.6.0 and have run into something strange. Compile info: 1. gcc 4.1.1 2. ./configure --enable-dynamicplugin --enable-dependency-tracking --with-libpcap-includes=/usr/include/ --with-libpcap-libraries=/usr/lib/ 3. Have tried libpcap 0.9.4 and the current version of phil woods libpcap 4. Gentoo Linux box 5. 'ifconfig eth0 up promisc' to bring the interface up No errors during ./configure && make && make install when I start snort it hangs for 15-30 seconds at... Initializing Network Interface eth0 OpenPcap() device eth0 network lookup: eth0: no IPv4 address assigned Decoding Ethernet on interface eth0 I'm starting it like this.. /usr/local/bin/snort -i eth0 -u snort -l /var/log/snort -c /usr/local/etc/snort/snort.conf also tried... /usr/local/bin/snort -i eth0 -l /var/log/snort -c /usr/local/etc/snort/snort.conf At this point memory consumption sky rockets to 95% usage even with all preprocessors except flow turned off. After about 30 seconds it finishes initializing and appears to work correctly but at 95% memory consumption and swap usage begins kicking in. I googled the OpenPcap message but found nothing that seems relevant to my situation. I also have a snort 2.4.5 install on the same box. When it starts I do not see the OpenPcap message and it works flawlessly at around 18-24% mem usage with all preprocessors on. I also tried compiling 2.6.0 without the new dynamic preprocessors or the dep tracking and I still get the openpcap message and crazy mem usage. Any ideas? Wally _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- OpenPcap() Gentoo-Wally (Jun 20)
- Re: OpenPcap() Joel Esler (Jun 20)
- Re: OpenPcap() Gentoo-Wally (Jun 20)
- Re: OpenPcap() Rob Munsch (Jun 20)
- Re: OpenPcap() Justin Heath (Jun 20)
- Re: OpenPcap() Gentoo-Wally (Jun 20)
- Re: OpenPcap() Gentoo-Wally (Jun 20)
- Re: OpenPcap() Joel Esler (Jun 20)