RE: Snort Exits Mysteriously

["Martijn Heemels" <martijn () yggdrasil yi org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi William,

i've seen a lot of people with this problem with snort 1.8.

I myself was running the 1.8 rpm from the snort website and was
having exactly the same problem.
Yesterday I decided to give cvs a try (first time ever) and compiled
the most recent cvs checkout version.
Until now it's still running fine (about 20 hours) while with the
stock 1.8 version it died after several hours.
I'm not sure it will keep running until it's been several days, but
at the moment it's looking good.

So, you might want to give the cvs version a try!
Download via cvs, ./configure, make, make install

Hope this helps,

Martijn

- -- 
.: M. Heemels .:. webdesigner :.
.: Eindhoven, NL, martijn () heemels com :.
.: PGP of S/MIME encrypted e-mail preferred :.

> *** PGP Signature Status: good
> *** Signer: William R. Blodgett (NA) <vigilant () cafe-mocha net>
> (Invalid) *** Signed: 9-8-2001 20:21:52
> *** Verified: 9-8-2001 22:01:51
> *** BEGIN PGP VERIFIED MESSAGE ***
>
> To All,
>
> Since upgrading to snort 1.8p1 snort has begun to mysteriously quit
> without any useful information being dropped into either the snort
> logs or the system logs.  Sometimes I can go for as long as 8
> hours, sometimes only 2 or 3 before it dies.  No core file is
> dropped.
>
> A bit of background on my system:
>
> x86 (P200 in a TX motherboard) w/128 megs of RAM
> ethernet is ne2000 compatible 10baseT (I can get the chipset if
> needed) Debian Linux 2.2r3 running kernel 2.4.4
> libpcap 0.6.2
> snort 1.8p1
> bone stock Snort 1.8 ruleset downloaded from the www.snort.org page
>
> *** END PGP VERIFIED MESSAGE ***

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com>

iQA/AwUBO3LuOxLMC0rbivl4EQJKrACg4EW/PPgaji9bGddYtUAc2hcJCWAAoL7e
3ipeuXgtWzmkPwJ4GVJKdEO7
=DnN9
-----END PGP SIGNATURE-----


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users