[Snort-users] Error: Can't set DAQ BPF filter to 'start'

Steve Crow scrow at ...16818...
Wed May 14 11:41:00 EDT 2014

Hi, I had snort working, after installing Wireshark and doing some testing I
rebooted. Now I get an error when trying to run snort. This is on Fedora 20.

Testing with:
cd /usr/sbin
./snort -T -I p1p1 -u snort -g snort -c /etc/snort/snort.conf
Snort successfully validated the config

snort start
Initializing Output Plugins!
Snort BPF option: start
pcap DAQ configured to passive.
Acquiring network traffic from "nflog".
ERROR: Can't set DAQ BPF filter to 'start' (pcap_daq_set_filter:
pcap_compile: syntax error)!
Fatal Error, Quitting..

So do I need to edit some files or permissions? What can I do to fix this?

Thank you!


More information about the Snort-users mailing list