[Snort-users] pcap_loop error?

Craig W codecraig at ...11827...
Mon Mar 7 12:02:04 EST 2005


Ok...well i was wondering b/c when i do ctrl+c, and the results are
printed out there is all 0's...meaning no packets received etc.  The
command I ran was snort -vde....any ideas?  I am connected to the
internet, and opened a browser and surfed around a little bit.

thanks


On Mon,  7 Mar 2005 13:05:11 -0600, Rich Adamson <radamson at ...2127...> wrote:
> 
> > Ok, so I am running Snort 2.3.0 RC2 (on win xp pro) and i installed
> > Win PCap 3.0.  When i run, snort -v at the command line...after about
> > 30seconds i press Ctrl +C (to stop it) and I get the following
> > message:
> >
> > pcap_loop: read error: PacketReceivePacket failed
> > Run time for packet processing was 30.54000 seconds
> >
> > any idea why?
> 
> That's very normal. Just disregard the error message. When I asked
> about it some time ago, I was told it had something to do with the
> way in which snort is shut down (ctrl c).
> 
> FYI, we have many implementation of win32 snort running at several
> banks. I don't think the win32 version can handle high volume traffic
> like the unix versions can, but I've not run into any dropped packets
> to speak of. If you type 'snort' with no arguments and read what is
> displayed, you'll see where it can be run as a Service as well.
> 
> When its run as a Service, it does not log errors to the Event Log, so
> you will want to run it manually after making any config changes, then
> if that is okay, start it as a Service.
> 
> Rich
> radamson at ...2127...
> 
> 


-- 

http://www.codecraig.com
http://jroller.com/page/codecraig




More information about the Snort-users mailing list