[Snort-users] XP / Snort / Error opening device

Chris Reid Chris.Reid at ...2817...
Sun Jun 30 12:59:02 EDT 2002


This is a known problem with older versions of winpcap.  It is a buffer
overflow which happens when you have a large number of interfaces defined
(ie. network cards, VPN, PPP, etc).  The version of Snort you mentioned
probably has an older winpcap compiled into it.  The current winpcap source
has increased the size of this buffer (from 1K to 8K), so it is much less
likely to occur.  More recent releases of Snort use the newer version of
winpcap.

The most recent relase for Win32 on snort.org is 1.8.5.  However, newer
releases for Win32 are available from silicondefense.com
(http://www.silicondefense.com/techsupport/downloads.htm).

Or, if you have Visual Studio, and want to compile you own executable, you
can download the source code.  Note that you will probably want to get
version 1.8.6 or 1.8.7.

Chris Reid


----- Original Message -----
From: "Robert Spinelli" <rspinell at ...741...>
To: <snort-users at lists.sourceforge.net>
Sent: Sunday, June 30, 2002 10:47 AM
Subject: [Snort-users] XP / Snort / Error opening device


> I have searched the archive and haven't seen a solution for this problem
> yet.
>
> I am getting the following error:
>
> ERROR: OpenPcap() device  open:
>         Error opening adapter
> Fatal Error, Quitting..
>
> Does anyone know how to fix this ?  I am running Snort v1.85 on Windows
> XP with WinPcap v 2.3. I have used Windump to verify that WinPCap is
> working, and that works fine.  I also have done snort -W and get the
> following info:
>
>
> Interface       Device          Description
> -------------------------------------------
> 1
>
> It only shows 1 interface with no name or description.
>
> I hope someone has an answer.
>
> Thanks
>
> Rob
>
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>






More information about the Snort-users mailing list