[Snort-users] Snort on ippp0 its possible ?

Martin Roesch roesch at ...421...
Mon Mar 12 01:48:04 EST 2001


Hi Andreas,
     Try capturing some of the packets with tcpdump like this:

tcpdump -s0 -n -w packet.log

then send the created packet.log to us once it has some packets in it
and we'll fix the decoders in Snort to support DLT 113...

    -Marty

> andreas wrote:
> 
> Hi,
> 
> I´ve tried at home to install snort on my linux-rh6.1-router with an
> ippp0(teles isdn card) interface
> 
> I am using Snort 1.7
> 
> I get the following message:
> 
>         --== Initializing Snort ==--
> 
> Initializing Network Interface ippp0
> 
> snort cannot handle data link type 113
> Exiting...
> 
> what does it means ??
> 
> I tried to run without the promisc mode but the same error :-(
> 
> I´ve 3 snort-sensors on other ethernet-machines everything works
> well.....so I think thats not a problem
> of the config or the command-line....
> 
> can anyone help ?
> 
> thx,reading
> 
> Andreas

--
Martin Roesch
roesch at ...421...
http://www.snort.org




More information about the Snort-users mailing list