[Snort-devel] Re: [Snort-users] Multiple interfaces

Denis Ducamp Denis.Ducamp at ...212...
Wed Jan 17 17:33:42 EST 2001


On Wed, Jan 17, 2001 at 09:49:46AM +0100, Denis Ducamp wrote:
> On Sun, Jan 14, 2001 at 02:42:15PM -0500, Chris Schuler wrote:
> > I installed lipbcap 0.6.1 and rebuilt snort and i get
> 
> Do you have a libc5 system with a 2.2.x or 2.4.x kernel ? If so then
> tcpdump.org removed the libc5 support while removing the 2.0.x kernel
> support... It's easy to compile a working libpcap library for libc5, but
> then it's without the "any" interface support.
> 
> I should write a quick and dirty patch for that tonight.

Last version of libpcap, only available from cvs server, works now fine on
libc5 + 2.2.x/2.4.x kernels thanks to Guy Harris as does the "-i any" option
from last tcpdump .

> > eye:~/snort-1.7# snort -i any -c /etc/snort/snortnoicmp.conf
> > 
> > 
> >         --== Initializing Snort ==--
> > 
> > Initializing Network Interface any
> > ioctl(SIOCGIFMTU): No such device
> > ERROR: Can not get MTU of an interface any!
> > 
> > I am assuming that is where you meant for me to specify 'any' as the
> > interface.
> 
> Yes. Did snort was compiled with the right libpcap ? Did you fully installed
> libpcap or did you add --with-libpcap-* to snort's configure ?

I have the same thing :-( with libc5 and glibc2 systems.

Who made it work yet ? I'll be happy to test any patch.

Denis Ducamp.

-- 
 Denis.Ducamp at ...212... --- Hervé Schauer Consultants --- http://www.hsc.fr/
snort, hping & dsniff en français : http://www.groar.org/~ducamp/#sec-trad
 Du bon usage de ... http://usenet-fr.news.eu.org/fr-chartes/rfc1855.html
  Netiquette Guidelines .... http://www.pasteur.fr/infosci/RFC/18xx/1855




More information about the Snort-devel mailing list