[Snort-users] modprobe error in log...
gammon.mcclure at ...4990...
Mon May 13 07:15:45 EDT 2002
I ran into the same non-issue and it made me crazy/more crazy until I looked at the source code: linux is searching for the module "reading from a file" which is set to prevent pcap from going bonkers when there's no interface defined, as when replaying a binary file. It's an artifact and can be ignored.
From: Bob Hillegas [mailto:bobhillegas at ...3133...]
Sent: Monday, May 13, 2002 9:37 AM
To: Matt Kettler
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] modprobe error in log...
Sorry for the lack of detail. Thanks for responding anyway.
snort 1.8.6 (build 105)
I have a processor connecting to the 'net by extrnal modem dial-up using pppd. I
capture ALL packets to log files. After the conection is terminated and the log
file complete, I issue the command:
snort -r log.file -u snort -g snort -c snort.conf
Since the modem is offline, and I'm dealing with a static tcpdump output file at
that point, this simplifies the possible interactions a bit. I always get the
incomplete error message logged:
modprobe: modprobe: Can't locate module [reading from a
What modules does snort depend on? I currently have loaded:
Module Size Used by Tainted: P
ip_nat_ftp 3488 0 (unused)
ip_conntrack_ftp 3808 0 (unused)
ppp_deflate 39104 0 (autoclean)
bsd_comp 4224 0 (autoclean)
ppp_async 6848 0 (autoclean)
ppp_generic 19336 1 (autoclean) [ppp_deflate bsd_comp ppp_async]
slhc 5056 1 (autoclean) [ppp_generic]
autofs 11300 1 (autoclean)
eepro100 17040 1 (autoclean)
ipt_REJECT 3392 1 (autoclean)
ipt_multiport 1152 5 (autoclean)
ipt_LOG 3872 22 (autoclean)
ipt_limit 1376 22 (autoclean)
ipt_state 1024 21 (autoclean)
iptable_mangle 2176 0 (autoclean) (unused)
ipt_MASQUERADE 1664 0 (autoclean)
ipt_REDIRECT 1152 1 (autoclean)
iptable_nat 16724 1 (autoclean) [ip_nat_ftp ipt_MASQUERADE ipt_REDIRECT]
ip_conntrack 15980 3 (autoclean) [ip_nat_ftp ip_conntrack_ftp ipt_state ipt_MASQUERADE ipt_REDIRECT iptable_nat]
iptable_filter 2144 0 (autoclean) (unused)
ip_tables 10976 12 [ipt_REJECT ipt_multiport ipt_LOG ipt_limit ipt_state iptable_mangle ipt_MASQUERADE ipt_REDIRECT iptable_nat iptable_filter]
st 25972 0 (unused)
usb-uhci 20708 0 (unused)
usbcore 49920 1 [usb-uhci]
sym53c8xx 55428 8
sd_mod 11964 8
scsi_mod 94616 3 [st sym53c8xx sd_mod]
<bobhillegas at ...3133...>
On Sat, 11 May 2002, Matt Kettler wrote:
> Date: Sat, 11 May 2002 12:01:54 -0400
> From: Matt Kettler <mkettler at ...4108...>
> To: Bob Hillegas <bobhillegas at ...3133...>, snort-users at lists.sourceforge.net
> Subject: Re: [Snort-users] modprobe error in log...
> Ok, can you be a bit less vague about your setup? it's hard to debug system
> configuration problems without knowing what kind of system you have. It
> sounds like one or more of your network interfaces don't have proper Linux
> drivers, but that's an educated guess at this point.
> Based on the problem being reported I assume you are running Linux. What
> distro? what release?
> What kind of network adapter is snort listening on?
> Do *all* of your network interfaces work normally? do you have drivers for
> all of them? Are you using a custom kernel? what libpcap do you have (ie:
> do you have a broken redhat libpcap or a real one?)
> At 10:33 PM 5/10/2002 -0500, Bob Hillegas wrote:
> >Every time I execute:
> >snort -r log.file -u snort -g snort -c snort.conf
> >I get an entry in syslog that states:
> >modprobe: modprobe: Can't locate module [reading from a
> >That's all I get. Any ideas what is needed?
> >BTW, the output shows all records read and 0 records logged. But it does
> >run to
> >completion with no apparent errors except for the log entry.
> >Thanks, BobH
Have big pipes? SourceForge.net is looking for download mirrors. We supply
the hardware. You get the recognition. Email Us: bandwidth at ...382...
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:
More information about the Snort-users