[Snort-devel] Compiling and Running Snort on MAC OSX 10.11.3 (El Capitan)

Joel Esler (jesler) jesler at ...3461...
Mon Feb 15 14:39:19 EST 2016

I don’t think that the interface would be called “eth0” on a mac.  You may want to make sure you have the right device specified.

Joel Esler
Manager, Talos Group

On Feb 12, 2016, at 5:04 PM, Madhu Rao <k.madhurao.123 at ...2499...<mailto:k.madhurao.123 at ...2499...>> wrote:

Hi Folks

Has anyone had Luck downloading and compiling snort and get it working on Latest MAC OS X El Capitan ?
I have a macbook pro running El Capitan. (OSX 10.11.3)

I See the following Errors when I run Snort.

$ sudo snort -c /etc/snort/snort.conf --daq pcap --daq-mode passive -i eth0 -k none

pcap DAQ configured to passive.

Acquiring network traffic from "eth0".

Reload thread starting...

Reload thread started, thread 0x700000081000 (41553)

ERROR: Can't start DAQ (-1) - BIOCSETIF failed: Device not configured!

Fatal Error, Quitting..

BTW - when I configured DAQ, this was the outcome.

$cd daq-2.0.6

./configure --disable-afpacket-module


Build AFPacket DAQ module.. : no
Build Dump DAQ module...... : yes
Build IPFW DAQ module...... : yes
Build IPQ DAQ module....... : no
Build NFQ DAQ module....... : no
Build PCAP DAQ module...... : yes
Build netmap DAQ module.... : no

Any pointers appreciated.

-- madhu

Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
Snort-devel mailing list
Snort-devel at lists.sourceforge.net

Please visit http://blog.snort.org for the latest news about Snort!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20160215/58600617/attachment.html>

More information about the Snort-devel mailing list