[Snort-users] Snort in daemon mode

Mark Kunzmann m25 at ...1171...
Fri Apr 13 08:30:34 EDT 2001


> > I get this error:
> >
> > Starting snort: Kernel filter, protocol ALL, raw packet socket [FAILED]
> >
> > Anymore ideas? Thanks for your help.
>
> Looks like it can't open a packet socket... Is libpcap properly
> installed with the libraries in you ld.so.conf path?

I have libpcap 0.4-19 installed on a RH 6.2 system. The paths as specified
in ld.so.conf are:

/usr/X11R6/lib
/usr/i486-linux-libc5/lib

On RH6.2 the following files are installed from the rpm for libpcap:

/usr/doc/libpcap-0.4
/usr/doc/libpcap-0.4/CHANGES
/usr/doc/libpcap-0.4/README
/usr/include/pcap
/usr/include/pcap/net
/usr/include/pcap/net/bpf.h
/usr/include/pcap/pcap-namedb.h
/usr/include/pcap/pcap.h
/usr/lib/libpcap.a
/usr/man/man3/pcap.3.gz


This machine does IP masquerading also. eth1 (a RealTek RTL8139) points to
the internet, eth0 (a 3Com 3c509) to the internal LAN. I have no problems
with the masq setup.
Thanks again,
Mark







More information about the Snort-users mailing list