[Snort-users] Multiple interfaces

Denis Ducamp Denis.Ducamp at ...199...
Wed Jan 17 03:49:46 EST 2001

On Sun, Jan 14, 2001 at 02:42:15PM -0500, Chris Schuler wrote:
> I installed lipbcap 0.6.1 and rebuilt snort and i get

Do you have a libc5 system with a 2.2.x or 2.4.x kernel ? If so then
tcpdump.org removed the libc5 support while removing the 2.0.x kernel
support... It's easy to compile a working libpcap library for libc5, but
then it's without the "any" interface support.

I should write a quick and dirty patch for that tonight.

> eye:~/snort-1.7# snort -i any -c /etc/snort/snortnoicmp.conf
>         --== Initializing Snort ==--
> Initializing Network Interface any
> ioctl(SIOCGIFMTU): No such device
> ERROR: Can not get MTU of an interface any!
> I am assuming that is where you meant for me to specify 'any' as the
> interface.

Yes. Did snort was compiled with the right libpcap ? Did you fully installed
libpcap or did you add --with-libpcap-* to snort's configure ?

Denis Ducamp.

 Denis.Ducamp at ...199... --- Hervé Schauer Consultants --- http://www.hsc.fr/
snort, hping & dsniff en français : http://www.groar.org/~ducamp/#sec-trad
 Du bon usage de ... http://usenet-fr.news.eu.org/fr-chartes/rfc1855.html
  Netiquette Guidelines .... http://www.pasteur.fr/infosci/RFC/18xx/1855

More information about the Snort-users mailing list