[Snort-users] Multiple interfaces
Denis.Ducamp at ...199...
Wed Jan 17 17:33:42 EST 2001
On Wed, Jan 17, 2001 at 09:49:46AM +0100, Denis Ducamp wrote:
> On Sun, Jan 14, 2001 at 02:42:15PM -0500, Chris Schuler wrote:
> > I installed lipbcap 0.6.1 and rebuilt snort and i get
> Do you have a libc5 system with a 2.2.x or 2.4.x kernel ? If so then
> tcpdump.org removed the libc5 support while removing the 2.0.x kernel
> support... It's easy to compile a working libpcap library for libc5, but
> then it's without the "any" interface support.
> I should write a quick and dirty patch for that tonight.
Last version of libpcap, only available from cvs server, works now fine on
libc5 + 2.2.x/2.4.x kernels thanks to Guy Harris as does the "-i any" option
from last tcpdump .
> > eye:~/snort-1.7# snort -i any -c /etc/snort/snortnoicmp.conf
> > --== Initializing Snort ==--
> > Initializing Network Interface any
> > ioctl(SIOCGIFMTU): No such device
> > ERROR: Can not get MTU of an interface any!
> > I am assuming that is where you meant for me to specify 'any' as the
> > interface.
> Yes. Did snort was compiled with the right libpcap ? Did you fully installed
> libpcap or did you add --with-libpcap-* to snort's configure ?
I have the same thing :-( with libc5 and glibc2 systems.
Who made it work yet ? I'll be happy to test any patch.
Denis.Ducamp at ...199... --- Hervé Schauer Consultants --- http://www.hsc.fr/
snort, hping & dsniff en français : http://www.groar.org/~ducamp/#sec-trad
Du bon usage de ... http://usenet-fr.news.eu.org/fr-chartes/rfc1855.html
Netiquette Guidelines .... http://www.pasteur.fr/infosci/RFC/18xx/1855
More information about the Snort-users