[Snort-users] Problems running 32 bit snort on a 64 bit linux kernel

Russ Combs rcombs at ...1935...
Thu Apr 7 10:57:54 EDT 2011


The DAQ tarball includes an NFQ module.

On Thu, Apr 7, 2011 at 10:32 AM, Sudarshan Raghavan <
sudarshan.t.raghavan at ...11827...> wrote:

> No specific reason. I was trying out a few things to familiarize myself
> with snort and saw this behavior.
>
> I also noticed that libnetfilter_queue is the replacement for the now
> deprecated libipq. Does snort work with libnetfiler_queue?
>
> Regards,
> Sudarshan
> On 07-Apr-2011 7:37 PM, "Russ Combs" <rcombs at ...1935...> wrote:
> > Looks like an ipq issue. Any reason not to use 64 on 64?
> >
> > On Thu, Apr 7, 2011 at 6:36 AM, Sudarshan Raghavan <
> > sudarshan.t.raghavan at ...11827...> wrote:
> >
> >> I am trying to get 32 bit snort up and running a 64 bit linux kernel
> >> (2.6.33.5). snort starts up fine but, I am seeing an error every time
> >> it has to process a packet. The error "Received error message 22" is
> >> printed for every packet that is read. If I switch to a 32 bit
> >> 2.6.33.5 kernel, I don't see any error and everything works fine. It
> >> looks like something is wrong with ipq_read and ipq_message_type
> >> returns a NLMSG_ERROR.
> >>
> >> Just to confirm, I compiled the sample code in ip_queue man page as a
> >> 32 bit binary and I am seeing the same error as seen on snort when
> >> running on a 64 bit kernel. As expected, the code works fine on a 32
> >> bit kernel.
> >>
> >> Is this the expected behaviour? Should snort be compiled as a 64 bit
> >> binary for it work on a 64 bit kernel. Please let me know if you need
> >> more information. If this is not a snort issue but a problem with
> >> netfilter and libipq, please let me know.
> >>
> >> Regards,
> >> Sudarshan
> >>
> >>
> >>
> ------------------------------------------------------------------------------
> >> Xperia(TM) PLAY
> >> It's a major breakthrough. An authentic gaming
> >> smartphone on the nation's most reliable network.
> >> And it wants your games.
> >> http://p.sf.net/sfu/verizon-sfdev
> >> _______________________________________________
> >> Snort-users mailing list
> >> Snort-users at lists.sourceforge.net
> >> Go to this URL to change user options or unsubscribe:
> >> https://lists.sourceforge.net/lists/listinfo/snort-users
> >> Snort-users list archive:
> >> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> >>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20110407/d6648ec3/attachment.html>


More information about the Snort-users mailing list