[Snort-users] OK it's time to update the FAQ...
alambert at ...387...
Fri Nov 17 12:02:35 EST 2000
> Q: I've got RedHat and ....
> A: Check your version of libpcap. :) If it's
> not <= 0.5, then you should update. (If you should update tht is... I'll let
> someone who knows RH better than I tackle that.)
For what it's worth, Snort actually works (as far as I can tell)
OK with the hacked up libpcap RedHat 6.2 comes with (and presumably the
whole 6.x series, although I haven't tried any of the others; I avoid
anything from redhat < *.2 releases).
However, if you're like me, and like to have your snort box watch
everything all the time, and a few dozen other little handy libpcap tools
on the same box in case you want to do some other analysis/snooping
around, then upgrading to the latest libpcap is highly recommended. A
reasonable amount of libpcap requiring utilities (such as the quite handy
DSniff tools) will be broken if you don't upgrade your libpcap.
More information about the Snort-users