[Snort-users] snort dying quietly

Fyodor fygrave at ...121...
Tue Nov 28 08:16:15 EST 2000


> traffic site (2 million page views per day) I started with snort
> ignoring HTTP traffic (i.e. I appended "not \( port 80 \)" at the end of
> the snort invocation). As ruleset I use the vision.rules.
> 
> I get regular messages " kernel: eth0: card reports no resources." and

Snort will exit with error message if your network interface goes down
for the moment. I think that's what you may be having here. As for
the reason why you have this message, I can only guess that it might
be promisc. mode which overloads your card since it has to process more
data than it does normally. I'd try to get different card installed
and see if it improves the situation :)


-- 
http://www.notlsd.net
PGP fingerprint = 56DD 1511 DDDA 56D7 99C7  B288 5CE5 A713 0969 A4D1



More information about the Snort-users mailing list