[Snort-users] Listening on two interfaces under Debian?

Fyodor fygrave at ...121...
Thu Mar 15 19:20:20 EST 2001

> Same as last time:
> Initializing Network Interface any
> ioctl(SIOCGIFMTU): No such device
> ERROR: Can not get MTU of an interface any!
> I am currently running libpcap 0.4a6 and It's a pretty old version I
> guess. Should I backport the libpcap 0.6.2 to my Debian 2.2 instead?
> Would that solve my problem?

Are you sure you're using lattest snort here?

This fix has been there for quite a while:

#ifdef LINUX
     * on linux platform with interface type 'any'
     * there's no way to automagically pick up mtu,
     * so we fall back to ETHERNET_MTU size....
     * later it should be replaced to a more sophisticated
     * routine: lookup for all interfaces, lookup for all
     * MTUs, pick up the biggest... :)
    if (!strcmp("any",name)) {
        return ETHERNET_MTU;

You shouldn't get to that error with snort-current.    

More information about the Snort-users mailing list