[Snort-users] Errors when initiating my sensors.

Wirth, Jeff WirthJe at ...4876...
Wed May 1 08:45:58 EDT 2002


From: Vadim Pushkin [mailto:wiskbroom at ...125...]
> obsd30# May  1 10:33:06 snort1 snort: FATAL ERROR: ERROR: 
> OpenPcap() device 
> eth1
> open:   /dev/bpf8: Device not configured
> May  1 10:33:06 snort1 snort: FATAL ERROR: ERROR: OpenPcap() 
> device eth1 
> open:
> /dev/bpf8: Device not configured

When *BSD is installed (this is true for FreeBSD, so I am assuming it's true
for OpenBSD) only 4 bpf devices are configured.../dev/bpf0 thru /dev/bpf3.
Guessing by your error you currently have /dev/bpf0 thru /dev/bpf7? So you
need to add another bpf device.

This works for FreeBSD (OpenBSD milage may vary..)

# su -
# cd /dev
# ./MAKEDEV bpf8

> 
> The above is an error that I get when I try to startup snort on a box
> with five sensors. I just upgraded from 1.8.3 to 1.8.6 and I did not
> have this problem under 1.8.3. Any ideas as to what is missing and
> or broken?
> 
> I am running on OpenBSD 3.0 and pushing data to a MySQL server, both
> mysql and openbsd boxes have been upgraded.
> 

- Jeff




More information about the Snort-users mailing list