[Snort-users] Error: Can't set DAQ BPF filter to 'start'

Y M snort at ...15979...
Wed May 14 12:59:52 EDT 2014


> ./snort -T -I p1p1 -u snort -g snort -c /etc/snort/snort.conf
>From the command above, I don't see where you specify the interface that Snort will be listening on through (-i) option.

> From: scrow at ...16818...
> To: snort-users at lists.sourceforge.net
> Date: Wed, 14 May 2014 10:41:00 -0500
> Subject: [Snort-users] Error: Can't set DAQ BPF filter to 'start'
> 
> Hi, I had snort working, after installing Wireshark and doing some testing I
> rebooted. Now I get an error when trying to run snort. This is on Fedora 20.
> 
> Testing with:
> cd /usr/sbin
> ./snort -T -I p1p1 -u snort -g snort -c /etc/snort/snort.conf
> Snort successfully validated the config
> 
> Then:
> snort start
> Error:
> Initializing Output Plugins!
> Snort BPF option: start
> pcap DAQ configured to passive.
> Acquiring network traffic from "nflog".
> ERROR: Can't set DAQ BPF filter to 'start' (pcap_daq_set_filter:
> pcap_compile: syntax error)!
> Fatal Error, Quitting..
> 
> So do I need to edit some files or permissions? What can I do to fix this?
> 
> Thank you!
> 
> Steve
> 
> 
> 
> ------------------------------------------------------------------------------
> "Accelerate Dev Cycles with Automated Cross-Browser Testing - For FREE
> Instantly run your Selenium tests across 300+ browser/OS combos.
> Get unparalleled scalability from the best Selenium testing platform available
> Simple to use. Nothing to install. Get started now for free."
> http://p.sf.net/sfu/SauceLabs
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> 
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20140514/8273270b/attachment.html>


More information about the Snort-users mailing list