[Snort-users] Listening on two interfaces under Debian?

Michael Boman michael at ...1290...
Thu Mar 15 20:39:10 EST 2001


Fyodor wrote:
> 
> 
> > Same as last time:
> >
> > Initializing Network Interface any
> > ioctl(SIOCGIFMTU): No such device
> > ERROR: Can not get MTU of an interface any!
> >
> >
> > I am currently running libpcap 0.4a6 and It's a pretty old version I
> > guess. Should I backport the libpcap 0.6.2 to my Debian 2.2 instead?
> > Would that solve my problem?
> >
> 
> Are you sure you're using lattest snort here?
> 
> This fix has been there for quite a while:
> 
> #ifdef LINUX
>     /*
>      * on linux platform with interface type 'any'
>      * there's no way to automagically pick up mtu,
>      * so we fall back to ETHERNET_MTU size....
>      *
>      * later it should be replaced to a more sophisticated
>      * routine: lookup for all interfaces, lookup for all
>      * MTUs, pick up the biggest... :)
>      */
>     if (!strcmp("any",name)) {
>         return ETHERNET_MTU;
>     }
> #endif
> 
> You shouldn't get to that error with snort-current.

Yes, checked the source (cvs update 2 mins ago) and I got it. Maybe it's
an issue with the gcc line?

gcc -DHAVE_CONFIG_H -I. -I. -I. -I/usr/include/pcap 
-I/usr/include/mysql -DENABLE_MYSQL -DENABLE_SSL -I/usr/include  -g -O2
-Wall -DENABLE_SMB_ALERTS -DENABLE_RESPONSE -D_BSD_SOURCE -D__BSD_SOURCE
-D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -DLIBNET_LIL_ENDIAN -c snort.c

Best regards
 Michael Boman 

-- 
"eLINUX  ---  Enabling the Net Economy on Linux"
----------------------------------------------------------
Michael Boman                   eLinux Pte Ltd
LPIC-1                          http://www.elinux.com.sg
Technical Consultant            Tel:    (65)  227 6180
michael at ...1290...           Fax:    (65)  227 5808
----------------------------------------------------------
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2022 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20010316/d7617a27/attachment.bin>


More information about the Snort-users mailing list