[Snort-users] Snort silently dying...

Carlos G Mendioroz tron at ...4514...
Wed Mar 11 19:07:41 EDT 2015

Y M @ 11/03/2015 18:06 -0300 dixit:
>> From: tron at ...4514...
>> To: snort at ...15979...
>> CC: snort-users at lists.sourceforge.net
>> Subject: Re: [Snort-users] Snort silently dying...
>> Nope, as I said, it silently died.
>> The only sign of it leaving was "adapter xxx left promiscuous mode".
>> What surprised me is that it had been working for ages (well, months)
>> and without any change it started dying. It sounds like some "new"
>> attack was sending it belly up. Too late now, I have already upgraded :)
> Good that you have gone through the upgrade. Just a total wild guess
> here, you may need to compile Snort with --enable-non-ether-decoders. If
> I recall properly on the list, this have solved some Snort "dying"
> issues. Not sure what you experienced is related to this or not.

I did have that option enabled (and kept it, as I'm sniffing ppp
sessions and sounds like needed).
Added --enable-sourcefire too based on some doc advise.

Carlos G Mendioroz  <tron at ...4514...>

More information about the Snort-users mailing list