[Snort-users] snort dying quietly

Austad, Jay austad at ...432...
Tue Nov 28 11:27:17 EST 2000


Snort doesn't die on my box, but I get console messages that say "eth1: card
reports no resources".  It's an Intel EEpro100 on a PIII 700.  It is
sniffing traffic on a portion of our network that serves out about 3 or 4
million page views a day.  Total bandwidth is about 32Mbit/sec during the
day.  I'll probably be moving snort to a different box sometime this week
which has 3com cards in it.  

Jay

> -----Original Message-----
> From: Fyodor [mailto:fygrave at ...121...]
> Sent: Tuesday, November 28, 2000 7:16 AM
> To: Juergen Schmidt
> Cc: snort-users at lists.sourceforge.net
> Subject: Re: [Snort-users] snort dying quietly
> 
> 
> > traffic site (2 million page views per day) I started with snort
> > ignoring HTTP traffic (i.e. I appended "not \( port 80 \)" 
> at the end of
> > the snort invocation). As ruleset I use the vision.rules.
> > 
> > I get regular messages " kernel: eth0: card reports no 
> resources." and
> 
> Snort will exit with error message if your network interface goes down
> for the moment. I think that's what you may be having here. As for
> the reason why you have this message, I can only guess that it might
> be promisc. mode which overloads your card since it has to 
> process more
> data than it does normally. I'd try to get different card installed
> and see if it improves the situation :)
> 
> 
> -- 
> http://www.notlsd.net
> PGP fingerprint = 56DD 1511 DDDA 56D7 99C7  B288 5CE5 A713 0969 A4D1
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> http://lists.sourceforge.net/mailman/listinfo/snort-users
> 



More information about the Snort-users mailing list