[Snort-users] OK it's time to update the FAQ...

A.L.Lambert alambert at ...387...
Fri Nov 17 12:02:35 EST 2000


> Q:  I've got RedHat and .... 
> A:  Check your version of libpcap.  :) If it's
> not <= 0.5, then you should update.  (If you should update tht is...  I'll let
> someone who knows RH better than I tackle that.)

	For what it's worth, Snort actually works (as far as I can tell)
OK with the hacked up libpcap RedHat 6.2 comes with (and presumably the
whole 6.x series, although I haven't tried any of the others; I avoid
anything from redhat < *.2 releases).

	However, if you're like me, and like to have your snort box watch
everything all the time, and a few dozen other little handy libpcap tools
on the same box in case you want to do some other analysis/snooping
around, then upgrading to the latest libpcap is highly recommended.  A
reasonable amount of libpcap requiring utilities (such as the quite handy
DSniff tools) will be broken if you don't upgrade your libpcap.

	--A.L.Lambert





More information about the Snort-users mailing list