[Snort-users] DAQ and ppp

James Lay jlay at ...13475...
Fri Dec 7 13:22:42 EST 2012


On 2012-12-07 11:18, Michael Altizer wrote:
> AFPacket currently only supports devices of the ARPHRD_ETHER (1) 
> device
> type.  ppp devices are ARPHRD_PPP (512).
>
> On 12/07/2012 01:07 PM, James Lay wrote:
>> Quick question...trying to run:
>>
>> sudo snort --daq afpacket -c intsnort.conf -i eth0:ppp0
>>
>> And I get:
>>
>> ERROR: Can't start DAQ (-1) - start_instance: invalid interface type
>> for device ppp0: 512 != 1!
>>
>> This is 2.9.3.1.  Any hints on what this could be?  Cursory google
>> wasn't fruitful.  Thanks all!
>>
>> James


Well...there it is then :)  Thanks Michael...that ends Today's 
Mystery(tm).

James




More information about the Snort-users mailing list