[Snort-users] snort dead but subsys locked error

Peter Bates peter.bates at ...15381...
Mon Sep 23 10:30:56 EDT 2013


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Hello all

On 23/09/2013 15:02, Hanson.Webster at ...16540... wrote:
> If I run snort -c /usr/local/snort/etc/snort.conf -T to test the configuration, it comes back OK:  Snort successfully validated the configuration!
> Snort exiting

Does the -T run okay if you specify an actual interface?

snort -i ethX -c /usr/local/snort/etc/snort.conf -T

I believe a change at some point menas that you have
to specify a capture interface to perform a proper test
otherwise it defaults to just demonstrating pcap-read mode (I think?).

- -- 
Peter Bates
Senior Information Security Officer   Phone: +44(0)2076792049
Information Services Division	      Internal Ext: 32049
University College London
London WC1E 6BT
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (MingW32)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBAgAGBQJSQFCgAAoJELhVoVpEMS6RDp0H/jfNAqc9deFsR4uP8zQNI1HB
mr289VUCKkwLTDRUDWmxrxdx8OXNeYx5LK6X749VZWlBsGiDuqpY8NuQ8wRn31Ne
cL2l+apoD4qGQsNn7T+79rmCBd1O6fxVzkFgJY3dN8a4UdannpWuSxPw5eATQmrt
n3FOhq8sOIqPxhqOV/oWOKbUbKb/NyOpWyn4xxyl493s/Kgi9LGYMgGJOpzGGiBy
+IFymw4TV7BneQ361uXImnCG1p/ImWCZdnV1bGn+K1p1LcEs/Jrf5vtfHDe4MRc9
dBmt7Ni8ilLc5lydjGD7e+DzgZR3wHdznN6Q3JIKRse7+bKSEvXJY69Oo8FLe1A=
=nc5t
-----END PGP SIGNATURE-----





More information about the Snort-users mailing list