[Snort-users] snort died for no reason

Patrick Harper patrick at ...4250...
Wed Sep 7 13:29:13 EDT 2005


How about upgrading snort?  It is good to keep up and ISM supports 2.0 and
higher according to the support site. 

The Sourcefire ISM Agent currently supports Red Hat Linux versions 7.2, 8.0,
and 9 running Snort 2.0 or higher.  What was the last update you did on the
OS?  Did you recently upgrade the kernel or libpcap?  If you upgraded either
(or other things too) then you might be having a problem with the RPM
install of 2.1.3.  I would go to 2.4


-----Original Message-----
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Wayne Ho
Sent: Wednesday, September 07, 2005 2:59 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] snort died for no reason

Dear all:

Recently Snort engine just die for no reason. When I
monitor /var/log/messages, it didn't indicate any
error. In addition, when I run tcpdump -i eth1 to
check the span port, tcpdump capture some packets, and
then froze, when I hit ctrl-C, I got lot of packets
dropped. I am using Snort 2.1.3 RPM, and with RH9.0.
Upgrade is not an option for me because the Sourcefire
ISM is running on it and this is the only version they
support.

Please advise.
Wayne








More information about the Snort-users mailing list