[Snort-users] Snort 2.9.1.2 exits on file upload

Sudarshan Raghavan sudarshan.t.raghavan at ...11827...
Thu Feb 2 09:09:10 EST 2012


I can see in the 2.8.5 sources that ipq_read error does not result in
snort exiting. It calls ipq_perror and continues to read. Is this an
ok behaviour to go back to. It is not ideal but having snort die is
not the best solution either. Can I get rid of the break in
PacketLoop?

On Thu, Feb 2, 2012 at 7:18 PM, Sudarshan Raghavan
<sudarshan.t.raghavan at ...11827...> wrote:
> Do I have to increase some buffer size? Can the -1 error from ipq_read
> be ignored? I am seeing this error every time I try to upload a 60MB
> file over HTTP.
>
> Regards,
> Sudarshan
>
> On Thu, Feb 2, 2012 at 7:05 PM, Sudarshan Raghavan
> <sudarshan.t.raghavan at ...11827...> wrote:
>> Snort Version: 2.9.1.2 IPv6 GRE
>> libpcap: 0.8.3
>> pcre: 7.0 18-Dec-2006
>> zlib: 1.2.3
>> Linux Kernel: 2.6.37.3 (32 bit)
>>
>> We are snort exit when trying a http file upload with this error
>> "Can't acquire (-1) - ipq_daq_acquire: ipq_read=-1 error Failed to
>> receive netlink message". Has anyone seen this error message before?
>>
>> Regards,
>> Sudarshan




More information about the Snort-users mailing list