[Snort-users] Snort and ippp0 Interface

Carsten Blume cblume at ...1789...
Wed Apr 11 05:50:16 EDT 2001


here is the error message i receive when i try to start snort
on my ippp0 interface.

Snort Version 1.7

www:/var/log # snort -edv -i ippp0
        --== Initializing Snort ==--
Initializing Network Interface ippp0
snort cannot handle data link type 113

While debugging i found the following  in snort.c :

* you need the I4L modified version of libpcap to get this stuff
* working

But where do i get this version? I fetched the latest version of libpcap
www.tcdump.org but i still get the same error message. (BTW: the version
on the download section is 0.4. The one available on www.tcdump.org is

I queried google but did not receive something useful except one message 
regarding bpf.h:

Could someone please tell me where i can get this *$%&$& version of libpcap
because having Snort listening on my internal eth0 interface is not
really exciting ;-)

Thanks in advance

Carsten Blume

N.B: please tell me if the tcpdump workers mailing list is a better
place for this e-mail

More information about the Snort-users mailing list