[Snort-devel] Cannot Open FIFO with "-r" in latest Snort Releases
twease at ...402...
Tue Oct 27 10:20:21 EDT 2009
I'll create a bug for this and respond.
Simon Dunstone wrote:
> Hi All,
> I'd like to report what I believe is a bug in recent Snort releases
> where a FIFO cannot be opened using the "-r" command line option.
> System Architecture: x86
> Operating System: RHEL5 v2.6.18-92.el5
> Snort Version: Reproduced error on v2.8.4 and v184.108.40.206
> This problem is most easily reproduced as follows:
> 1. Create a FIFO (mkfifo /tmp/test.fifo)
> 2. snort -r /tmp/test.fifo
> Snort produces the following error output:
> --== Initializing Snort ==--
> Specified pcap is not a regular file: /tmp/test.fifo
> ERROR: Error getting pcaps.
> Fatal Error, Quitting..
> I can confirm that this worked in v2.7.0.
> To get it working again locally I have modified line #5470 of
> "parser.c" to allow both S_IFREG and S_IFIFO modes.
> Let me know if you need any more information.
> Simon Dunstone
More information about the Snort-devel