[Snort-users] DAQ and ppp

James Lay jlay at ...13475...
Fri Dec 7 13:14:34 EST 2012


On 2012-12-07 11:10, Greg Williams wrote:
> Ppp0 should be its own interface.  Try: sudo snort --daq afpacket -c
> intsnort.conf -i ppp0
>
> -----Original Message-----
> From: James Lay [mailto:jlay at ...13475...]
> Sent: Friday, December 07, 2012 11:07 AM
> To: Snort-users
> Subject: [Snort-users] DAQ and ppp
>
> Quick question...trying to run:
>
> sudo snort --daq afpacket -c intsnort.conf -i eth0:ppp0
>
> And I get:
>
> ERROR: Can't start DAQ (-1) - start_instance: invalid interface type
> for device ppp0: 512 != 1!
>
> This is 2.9.3.1.  Any hints on what this could be?  Cursory google
> wasn't fruitful.  Thanks all!
>
> James


Hrmm....my whole testing of this was to have one instance of snort, 
listening to two interfaces.  My tests worked with eth0 and 
say...another eth1 or eth2.  Even worked with eth0:wlan0.  Is this not a 
possibility with ppp interfaces?  And that's for the quick response 
Greg.

James





More information about the Snort-users mailing list