[Snort-devel] Cannot Open FIFO with "-r" in latest Snort Releases

Todd Wease twease at ...402...
Tue Oct 27 10:26:25 EDT 2009


Hi Simon,

Thanks for the report.  A bug has been created to fix the issue.

Todd

Simon Dunstone wrote:
> Hi All,
>
> I'd like to report what I believe is a bug in recent Snort releases
> where a FIFO cannot be opened using the "-r" command line option.
>
> System Architecture: x86
> Operating System: RHEL5 v2.6.18-92.el5
> Snort Version: Reproduced error on v2.8.4 and v2.8.5.1
>
> This problem is most easily reproduced as follows:
>
>    1. Create a FIFO (mkfifo /tmp/test.fifo)
>    2. snort -r /tmp/test.fifo
>
> Snort produces the following error output:
>
> --== Initializing Snort ==--
> ...
> ...
> Specified pcap is not a regular file: /tmp/test.fifo
> ERROR: Error getting pcaps.
> Fatal Error, Quitting..
>
>
> I can confirm that this worked in v2.7.0.
>
> To get it working again locally I have modified line #5470 of
> "parser.c" to allow both S_IFREG and S_IFIFO modes.
>
> Let me know if you need any more information.
>
> Regards,
> Simon Dunstone





More information about the Snort-devel mailing list