[Snort-users] Stubbourn Pcap Error

Chris Reid chris.reid at ...3029...
Mon May 27 10:45:14 EDT 2002


This problem is due to a buffer overrun within winpcap (or libpcap -- I
can't remember which) encountered when you have a large number of interfaces
defined.  For example, additional interfaces for VPN, etc.  The libpcap
compiled into snort 1.8.6 is old, and is most likely to have this error.
The source for the current libpcap increases the size of the buffer (from 1K
to 8K), and the overrun is much less likely to be encountered.

The current Win32 libpcap (with the larger buffer) has been added to the
1.8.7 (?) branch, as well as the 1.9 branch.  Your options are:

*  Compile using the latest CVS source (either 1.8.x or 1.9)
*  Find an organization which provides precompiled binaries for 1.8.7 or 1.9

Looking at the www.snort.org website, they seem to only have 1.8.6
precompiled for download.  Silicon Defense has 1.8.7 binaries
(http://www.silicondefense.com/techsupport/downloads.htm).

Chris Reid



----- Original Message -----
From: "Hicks, John" <JHicks at ...5857...>
To: "Snort Users (E-mail)" <snort-users at lists.sourceforge.net>
Sent: Monday, May 27, 2002 11:01 AM
Subject: [Snort-users] Stubbourn Pcap Error


> Hello all,
>
> I have been trying to install snort on a new setup (Windows 2000
> Server/IIS5) and have been getting the following error:
>
> ERROR: OpenPcap() device open: Error opening adapter: Overlapped i/o
> operation is in progress.
>
> Additionally, when runnign snort -W, i see the following:
>
> Interface Device Description
> 1
>
> I ran into a similar issue which reinstalling WinPcap helped, but i've
tried
> redoing it 5 times to no avail. Any ideas???
>
> Thanks in advance,
>
> John Hicks
>
> _______________________________________________________________
>
> Don't miss the 2002 Sprint PCS Application Developer's Conference
> August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm
>
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>






More information about the Snort-users mailing list