[Snort-users] ERROR: OpenPcap() FSM compilation failed:

hadi tounsi hdtounsi at ...11827...
Sun Feb 27 05:04:08 EST 2011


thank you very much to accept help me to resolve the problem ,


in first  when i start snort like service in  /etc/init.d/snort start   it
work properly  , but when  try to start sent event from  snort installed in
windows platform (windows server 2003 ) to linux platform  and i
reconfigure  snort.conf like :

output database: alert, mysql , user=root password=xxxxxxxxx dbname=snort
host=192.168.0.20 logfile=fast_alert.log
output database: log, mysql  , user=root password=xxxxxxxxxx dbname=snort
host=192.168.0.20 logfile=fast_log.log


c:\python27\python.exe ossim-agent -v -c c:\snort\etc\ossim\agent\config.cfg

but when i try to connect to server  ,established successful , but after
when i try to restart snort service it been message if error :
No snort instance found to be stopped! failed!

the command using  : snort -c /etc/snort/snort.conf -l /var/log/snort/ -i 1
but when i use the command : snort -c /etc/snort/snort.conf -l
/var/log/snort/ -i eth0  it work  ,and   it sent event snort in
/var/log/snort/  without  Using PCAP_FRAMES

the version of my  system  is : Debian GNU/Linux 5.0 \n \l


best regard     hadi tounsi

security network

2011/2/25 Nick Moore <nmoore at ...1935...>

> Hadi,
>
> I'm not sure what distro you are using nor if you compiled from scratch,
> but here are some things I would check:
>
> - Is daq properly compiled and installed?
>
> - Do you have all the proper pcap libraries installed in place where snort
> can find them?
>
> - What command are you using to start snort?
>
> In order to provide better help, we would need to kmow your llinux version,
> your snort startup command, any set up guides you used....
>
> Please lst us know.
>
> Sent from my mobile
>
> Nick Moore
>
> On Feb 24, 2011 9:50 PM, "hadi tounsi" <hdtounsi at ...11827...> wrote:
>
> hello , i try to restat snort but it showing the following message :
>
>
> *** interface device lookup found: eth0
> ***
>
> Initializing Network Interface eth0
> ERROR: OpenPcap() FSM compilation failed:
>         syntax error
> PCAP command: restart
>
>
>
>
> please help me to get solution for the problem
>
>
> regards hadi tounsi
>
> security network
>
>
> ------------------------------------------------------------------------------
> Free Software Download: Index, Search & Analyze Logs and other IT data in
> Real-Time with Splunk. Collect, index and harness all the fast moving IT
> data
> generated by your applications, servers and devices whether physical,
> virtual
> or in the cloud. Deliver compliance at lower cost and gain new business
> insights. http://p.sf.net/sfu/splunk-dev2dev
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20110227/692d415b/attachment.html>


More information about the Snort-users mailing list