From: Marco S. <mar...@cl...> - 2002-03-25 14:14:07
Attachments:
smime.p7s
|
Hi, first the new Beta6 is a great peace of software! I tried to run the snort package with a small basic configuration. But on startup snort dies. I see the following in syslog: eth0: Setting promiscuous mode. Mar 25 14:36:13 devil src@Devil device eth0 entered promiscuous mode Mar 25 14:36:13 devil src@Devil snort: ERROR: OpenPcap() FSM compilation failed: Mar 25 14:36:13 devil src@Devil ^Iparse error Mar 25 14:36:13 devil src@Devil snort: FATAL ERROR: PCAP command: /etc/snort/snort.conf Mar 25 14:36:13 devil src@Devil device eth0 left promiscuous mode Is my devil-linux missing something here? Do I have to install additional packages? I don't know if it's a snort or devil-linux related problem. Searching the usenet did not really help. Any suggestion would be great! Thanx marco |
From: Friedrich L. <fl...@fl...> - 2002-03-25 14:29:07
|
On Mon, 25 Mar 2002 15:12, Marco Schierle wrote: > eth0: Setting promiscuous mode. > Mar 25 14:36:13 devil src@Devil device eth0 entered promiscuous mode > Mar 25 14:36:13 devil src@Devil snort: ERROR: OpenPcap() FSM compilation > failed: > Mar 25 14:36:13 devil src@Devil ^Iparse error > Mar 25 14:36:13 devil src@Devil snort: FATAL ERROR: PCAP command: > /etc/snort/snort.conf > Mar 25 14:36:13 devil src@Devil device eth0 left promiscuous mode I would guess that your config file is not correct but "parse error" hints that. PS: I never used snort before :) -- MfG / Regards Friedrich Lobenstock |
From: Marco S. <mar...@cl...> - 2002-03-25 14:39:55
Attachments:
smime.p7s
|
I thought the same and tested if a fresh config file without changing anything works. But I got the same message. but thanx very much marco -----Ursprungliche Nachricht----- Von: dev...@li... [mailto:dev...@li...]Im Auftrag von Friedrich Lobenstock Gesendet: Montag, 25. Marz 2002 15:29 An: Devil Linux Discuss Mailing Liste Betreff: Re: [Devil-Linux-discuss] Is Snort missing something On Mon, 25 Mar 2002 15:12, Marco Schierle wrote: > eth0: Setting promiscuous mode. > Mar 25 14:36:13 devil src@Devil device eth0 entered promiscuous mode > Mar 25 14:36:13 devil src@Devil snort: ERROR: OpenPcap() FSM compilation > failed: > Mar 25 14:36:13 devil src@Devil ^Iparse error > Mar 25 14:36:13 devil src@Devil snort: FATAL ERROR: PCAP command: > /etc/snort/snort.conf > Mar 25 14:36:13 devil src@Devil device eth0 left promiscuous mode I would guess that your config file is not correct but "parse error" hints that. PS: I never used snort before :) -- MfG / Regards Friedrich Lobenstock _______________________________________________ Devil-linux-discuss mailing list Dev...@li... https://lists.sourceforge.net/lists/listinfo/devil-linux-discuss |
From: Heiko Z. <he...@zu...> - 2002-03-26 02:40:31
|
On Mon, 25 Mar 2002 15:38:00 +0100 "Marco Schierle" <mar...@cl...> wrote: > I thought the same and tested if a fresh config file without changing > anything works. But I got the same message. I can reproduce this error, but couldn't find the problem yet. I keep on investigating. -- cu Heiko http://www.devil-linux.org |
From: Heiko Z. <he...@zu...> - 2002-03-26 03:30:23
|
autsch.... I found it: edit the file /etc/init.d/snort and write the line with PARAMETER= like this: PARAMETER="-D -c /etc/snort/snort.conf" -- cu Heiko http://www.devil-linux.org |