[Snort-users] pcap DAQ does not support inline

Joao Daniel Neves joaodanielnevesss at ...125...
Mon Apr 22 11:46:19 EDT 2013


Hi,

I'm getting this error when running Snort in inline mode "ERROR: pcap DAQ does not support inline". I have searched on Google, but did not get any thing usefull. The point is I don't even know why this happening. 

What do you suggest ?

Some informations for debugging: 

My daq dir is /usr/local/lib/daq

ls /usr/local/lib/daq
daq_afpacket.la
daq_afpacket.so
daq_dump.la
daq_dump.so
daq_ipfw.la
daq_ipfw.so
daq_pcap.la
daq_pcap.so

I tryed to start Snort with 

/usr/local/bin/snort -Q -i eth1 --daq-dir /usr/local/lib/daq/ -c /etc/snort/snort.conf
/usr/local/bin/snort -Q -de *--daq nfq* --daq-dir /usr/local/lib/daq -c /etc/snort/snort.conf
/usr/local/bin/snort  —daq pcap -Q -c /etc/snort/snort.conf -i eth0:eth1
/usr/local/bin/snort -Q -c /etc/snort/snort.conf -i eth0:eth1

None of them worked.

Some more informations

/usr/lib/libpcap.a
/usr/lib/libpcap.so
/usr/lib/libpcap.so.0
/usr/lib/libpcap.so.0.9
/usr/lib/libpcap.so.0.9.4
/usr/lib/libpcap.so.1
/usr/lib/libpcap.so.1.3.0
/usr/lib64/libpcap.so.0
/usr/lib64/libpcap.so.0.9
/usr/lib64/libpcap.so.0.9.4
/usr/local/lib/libpcap.a
/usr/local/lib/libpcap.so
/usr/local/lib/libpcap.so.1
/usr/local/lib/libpcap.so.1.3.0
/usr/local/lib/daq/daq_pcap.la
/usr/local/lib/daq/daq_pcap.so

Maybe those multiple versions of pcap are causing the error ?
 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130422/ecad5e87/attachment.html>


More information about the Snort-users mailing list