[Snort-users] Snort and ippp0 Interface

Carsten Blume cblume at ...1789...
Wed Apr 11 05:50:16 EDT 2001


Hi,

here is the error message i receive when i try to start snort
on my ippp0 interface.

Snort Version 1.7

www:/var/log # snort -edv -i ippp0
        --== Initializing Snort ==--
Initializing Network Interface ippp0
snort cannot handle data link type 113
Exiting...

While debugging i found the following  in snort.c :

/*
* you need the I4L modified version of libpcap to get this stuff
* working
*/

But where do i get this version? I fetched the latest version of libpcap
from
www.tcdump.org but i still get the same error message. (BTW: the version
available 
on the download section is 0.4. The one available on www.tcdump.org is
0.6.2).

I queried google but did not receive something useful except one message 
regarding bpf.h:
http://archives.neohapsis.com/archives/snort/2001-02/0338.html

Could someone please tell me where i can get this *$%&$& version of libpcap
because having Snort listening on my internal eth0 interface is not
really exciting ;-)

Thanks in advance

Carsten Blume

N.B: please tell me if the tcpdump workers mailing list is a better
place for this e-mail




More information about the Snort-users mailing list