Re: Stubbourn Pcap Error

["Chris Reid" <chris.reid () codecraftconsultants com>]

This problem is due to a buffer overrun within winpcap (or libpcap -- I
can't remember which) encountered when you have a large number of interfaces
defined.  For example, additional interfaces for VPN, etc.  The libpcap
compiled into snort 1.8.6 is old, and is most likely to have this error.
The source for the current libpcap increases the size of the buffer (from 1K
to 8K), and the overrun is much less likely to be encountered.

The current Win32 libpcap (with the larger buffer) has been added to the
1.8.7 (?) branch, as well as the 1.9 branch.  Your options are:

*  Compile using the latest CVS source (either 1.8.x or 1.9)
*  Find an organization which provides precompiled binaries for 1.8.7 or 1.9

Looking at the www.snort.org website, they seem to only have 1.8.6
precompiled for download.  Silicon Defense has 1.8.7 binaries
(http://www.silicondefense.com/techsupport/downloads.htm).

Chris Reid



----- Original Message -----
From: "Hicks, John" <JHicks () JUSTICE GC CA>
To: "Snort Users (E-mail)" <snort-users () lists sourceforge net>
Sent: Monday, May 27, 2002 11:01 AM
Subject: [Snort-users] Stubbourn Pcap Error


> Hello all,
>
> I have been trying to install snort on a new setup (Windows 2000
> Server/IIS5) and have been getting the following error:
>
> ERROR: OpenPcap() device open: Error opening adapter: Overlapped i/o
> operation is in progress.
>
> Additionally, when runnign snort -W, i see the following:
>
> Interface Device Description
> 1
>
> I ran into a similar issue which reinstalling WinPcap helped, but i've
tried
> redoing it 5 times to no avail. Any ideas???
>
> Thanks in advance,
>
> John Hicks
>
> _______________________________________________________________
>
> Don't miss the 2002 Sprint PCS Application Developer's Conference
> August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



_______________________________________________________________

Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users