[Snort-users] 2GB limit?

Florin Andrei florin at ...3506...
Tue Jan 14 15:20:02 EST 2003

On Thu, 2003-01-09 at 09:47, Sammy X wrote:
> Has anyone else run into any problems where logging in tcpdump format stops once the log file reaches 2GB?  I'm using Snort 1.8.6 (Build 105) on a Redhat 7.2 box with kernel 2.4.7-10.  My libpcap is the one the came with Redhat (0.6.2-9).  From what I've read so far, it looks like the problem is with libpcap not having been compiled with LFS.  Any thoughts/suggestions?  Any help is greatly appreciated!  Thanks in advance.

Whenever i ran into 2GB problems on kernel-2.4 system, it was always
either a library or an application that wasn't compiled and/or
configured correctly. It was never the kernel, as the recent kernels
support large files easily.

Florin Andrei

"When you say 'I wrote a program that crashed Windows',
people just stare at you blankly and say:
'Hey, I got those with the system, for free'". - Linus Torvalds

More information about the Snort-users mailing list