[Snort-users] snort suddenly not capturing packets

Carter Waxman (cwaxman) cwaxman at ...589...
Thu Jan 9 09:02:33 EST 2014

Hello Ben,

Just out of curiosity, are you using the pcap DAQ? What version of libpcap do you have installed? I have experienced the same issue with Arch x64 and it seems to be tied to a versioning issue (libpcap 1.5.1-1 and above breaks in my case). Try either using the afpacket DAQ (add —daq afpacket to the command line) or downgrading to libpcap 1.4.0 (here is a link for convenience: http://www.tcpdump.org/release/libpcap-1.4.0.tar.gz).

Let me know how that works,

From: Ben Jacobs-Swearingen <bjsdaiyu at ...11827...<mailto:bjsdaiyu at ...14459.....>>
Date: Wednesday, January 8, 2014 7:39 PM
To: "snort-users at lists.sourceforge.net<mailto:snort-users at ...5870....net>" <snort-users at lists.sourceforge.net<mailto:snort-users at ...2987...rge.net>>
Subject: [Snort-users] snort suddenly not capturing packets


I recently restarted snort  on an ArchLinux ARM (Raspberry Pi) sensor with new rules (and a slightly modified snort.conf) ; the post-reboot snort will launch without explicit errors but appears not to be listening to any interfaces on the sensor and I am unable to figure out why.  Snort had been working correctly for months prior to this change.

The sensor has two interfaces, eth0 and eth1; mirrored traffic (for snort to process) is being sent to eth0 (which is up and running though it does not have a configured IP address), while eth1 has a configured address on an admin segment. prior to changing the rules and rebooting snort, snort was listening to and correctly processing traffic on eth0.

-  "tcpdump -i eth0" works just fine, it sees all mirrored traffic

- "snort -dev -l . -i eth0" makes it to the "listening" stage but appears to not pick up any of the traffic i generate across the interface; again, tcpdump sees this traffic just fine.  "snort -dev ..."  also does not work when I set it to listen on eth1 (tcpdump works there as well).

- "snort -r <bad.pcap> -c .../snort.conf" with <bad.pcap> containing traffic I want flagged DOES work correctly: the traffic is processed according to the rules, alerts are correct and sent to the correct repository.

I suspect my changes to snort.conf might have introduced a problem that I simply am not seeing so have attached the conf file for examination (but am confused in that case why "snort -r" is working since it's using the same conf file).

Alternately, I have attached an strace in case something with the interface setup somehow got screwed up (as suggest by the fact that snort replay is working). I see in strace there are some errors with setsockopt(...) which might be more relevant to the capturing issue; any idea what might be causing those, assuming that those aren't par for the course?

The only similar posts I could find on this topic discuss various issues with DAQ; I don't see how those might apply in my case since the installation was working for months prior to today.

Thanks for any help.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20140109/9ee01558/attachment.html>

More information about the Snort-users mailing list