[Snort-users] modprobe error in log...

Bob Hillegas bobhillegas at ...3133...
Mon May 13 06:40:01 EDT 2002


Sorry for the lack of detail. Thanks for responding anyway.
Pentium processor
kernel 2.4.9-31
tcpdump 3.6.2-10.7
snort 1.8.6 (build 105)
iptables 1.2.5-3
ppp-2.4.0-2

I have a processor connecting to the 'net by extrnal modem dial-up using pppd. I 
capture ALL packets to log files. After the conection is terminated and the log 
file complete, I issue the command:
snort -r log.file -u snort -g snort -c snort.conf

Since the modem is offline, and I'm dealing with a static tcpdump output file at
that point, this simplifies the possible interactions a bit. I always get the
incomplete error message logged: 
modprobe: modprobe: Can't locate module [reading from a

What modules does snort depend on? I currently have loaded:

Module                  Size  Used by    Tainted: P  
ip_nat_ftp              3488   0  (unused)
ip_conntrack_ftp        3808   0  (unused)
ppp_deflate            39104   0  (autoclean)
bsd_comp                4224   0  (autoclean)
ppp_async               6848   0  (autoclean)
ppp_generic            19336   1  (autoclean) [ppp_deflate bsd_comp ppp_async]
slhc                    5056   1  (autoclean) [ppp_generic]
autofs                 11300   1  (autoclean)
eepro100               17040   1  (autoclean)
ipt_REJECT              3392   1  (autoclean)
ipt_multiport           1152   5  (autoclean)
ipt_LOG                 3872  22  (autoclean)
ipt_limit               1376  22  (autoclean)
ipt_state               1024  21  (autoclean)
iptable_mangle          2176   0  (autoclean) (unused)
ipt_MASQUERADE          1664   0  (autoclean)
ipt_REDIRECT            1152   1  (autoclean)
iptable_nat            16724   1  (autoclean) [ip_nat_ftp ipt_MASQUERADE ipt_REDIRECT]
ip_conntrack           15980   3  (autoclean) [ip_nat_ftp ip_conntrack_ftp ipt_state ipt_MASQUERADE ipt_REDIRECT iptable_nat]
iptable_filter          2144   0  (autoclean) (unused)
ip_tables              10976  12  [ipt_REJECT ipt_multiport ipt_LOG ipt_limit ipt_state iptable_mangle ipt_MASQUERADE ipt_REDIRECT iptable_nat iptable_filter]
st                     25972   0  (unused)
usb-uhci               20708   0  (unused)
usbcore                49920   1  [usb-uhci]
sym53c8xx              55428   8 
sd_mod                 11964   8 
scsi_mod               94616   3  [st sym53c8xx sd_mod]


Thanks, BobH
-- 
-------------------------------------------------
Bob Hillegas           
<bobhillegas at ...3133...> 

On Sat, 11 May 2002, Matt Kettler wrote:

  > Date: Sat, 11 May 2002 12:01:54 -0400
  > From: Matt Kettler <mkettler at ...4108...>
  > To: Bob Hillegas <bobhillegas at ...3133...>, snort-users at lists.sourceforge.net
  > Subject: Re: [Snort-users] modprobe error in log...
  > 
  > Ok, can you be a bit less vague about your setup? it's hard to debug system 
  > configuration problems without knowing what kind of system you have. It 
  > sounds like one or more of your network interfaces don't have proper Linux 
  > drivers, but that's an educated guess at this point.
  > 
  > Based on the problem being reported I assume you are running Linux. What 
  > distro? what release?
  > 
  > What kind of network adapter is snort listening on?
  > 
  > Do *all* of your network interfaces work normally? do you have drivers for 
  > all of them? Are you using a custom kernel? what libpcap do you have (ie: 
  > do you have a broken redhat libpcap or a real one?)
  > 
  > 
  > At 10:33 PM 5/10/2002 -0500, Bob Hillegas wrote:
  > >Every time I execute:
  > >snort -r log.file -u snort -g snort -c snort.conf
  > >I get an entry in syslog that states:
  > >modprobe: modprobe: Can't locate module [reading from a
  > >That's all I get. Any ideas what is needed?
  > >BTW, the output shows all records read and 0 records logged. But it does 
  > >run to
  > >completion with no apparent errors except for the log entry.
  > >
  > >Thanks, BobH
  > 






More information about the Snort-users mailing list