[Snort-users] error: pcap_loop: recvfrom: Socket operation on non-socket

Florian Huber florian.huber at ...7391...
Thu Nov 7 12:16:04 EST 2002

running snort 1.9.0 on a SuSE 7.2 box from a cronjob i get following errors:
    snort: pcap_loop: recvfrom: Socket operation on non-socket
    snort: Snort received signal 3, exiting

But i have no problems when starting snort from commandline.
I found out that someone had this problem before, but i don't know how to
handle his solution:

    Mark Wormgoor
    Wed Jan 02 2002 - 01:51:20 PST
    > On Sun, Dec 30, 2001 at 10:59:52AM +0100, Mark Wormgoor wrote:
    > > I have a small problem with starting snort from another program. I'm
    > > running snort 1.8.3 (from RPM) on a Redhat 7.2 based system.
    > > When I start snort from the command line, it will start just fine:
    > > /usr/sbin/snort -c /etc/snort/snort.conf -D -u snort -g
snort -d -e -z
    > running snort non-root , while I nice idea, turns out to be a problem.
    had this same problem with my Demarc/Snort installation. I can't
    the specific internal problems, but this stems from your other program
    having access to the pcap device, something along those lines...
    > running snort as root, really doesn't hurt that much either ;)

    Well, I managed to solve the problem myself. Snort is started from a
    program. Therefor, stdin and stdout were closed before the system call
    start snort. Older versions of snort had no problems with this (1.8.1
    I have changed the program to reopen stdin from /dev/zero and stdout to
    /dev/null and my problem is solved :)

    Kind regards,

        Mark Wormgoor


I hope that anyone can help me. Is this problem fixed in Snort 2.0?


     Florian Huber

More information about the Snort-users mailing list