[Snort-devel] Running pthread enabled snort?

Dirk Geschke dirk at ...972...
Thu Nov 22 13:44:02 EST 2001


Hi all,

I tried to build snort with pthread enabled. The idea is to try running
one instace of snort on more than one interface. The source code implies
that this could be possible...

After a long fight I got snort compiled with pthreads (I had to install
the GNU Pth to get it compile without errors). Snort starts without
problems but it seems to pick up no packets. 

So is there something wrong with the pthreaded code or do I mistakes
if I compile it? Is this behaviour known, e.g. have I to search the
mistake within the snort sources or is it a compiling problem related
to the (maybe) wrong libpthread?

The background is: If I use a tool like a shomiti tap I need at least
two ethernet cards to sniff the whole traffic, one for ingoing traffic
and one for outgoing. Therefore it would be nice to catch all the 
traffic with only one running snort...

Best regards

Dirk
--
+------------------------------------------------------------+
| Dr. Dirk Geschke            | E-mail: geschke at ...802...     |
| Gesellschaft fuer Netzwerk  | Tel.  : +49-(0)-89-991950-31 |
| und Unix Administration mbH | Fax   : +49-(0)-89-991950-99 |
| 85551 Kirchheim / Germany   | Raeter Stra/3e 26            |
+------------------------------------------------------------+






More information about the Snort-devel mailing list