Snort mailing list archives
Re: Snort problems
From: Adam Kennedy <akennedy () niesc k12 in us>
Date: Fri, 07 Mar 2003 14:22:34 -0500
Erek Adams wrote:
On Thu, 6 Mar 2003, Adam Kennedy wrote:I've got so far one server that snort is installed on, but after running snort (snort -D -d -c /etc/snort/snort.conf -i eth0 -l /var/log/snort) it spits the following into the syslog, then dies silently: Mar 6 14:12:56 changeme kernel: device eth0 left promiscuous modeWhat version of snort? If you are using binary logging, then remove the -d parameter. Remove the -D and then start snort by hand. See if it initializes and runs at all. Does it leave a core file when it dies? If so, get a backtrace from gdb and see what the output is. If it doesn't core, start snort under gdb and see what causes it to die.
Snort 1.9.1I've removed the -D from snort, and ran it. Here's the output (not sure if list strips attachments, but just in case):
## Begin Log Log directory = /var/log/snort Initializing Network Interface eth0 --== Initializing Snort ==-- Initializing Output Plugins! Decoding Ethernet on interface eth0 Parsing Rules file /etc/snort/snort.conf +++++++++++++++++++++++++++++++++++++++++++++++++++ Initializing rule chains... Initializing Preprocessors! Initializing Plug-ins! No arguments to frag2 directive, setting defaults to: Fragment timeout: 60 seconds Fragment memory cap: 4194304 bytes Fragment min_ttl: 0 Fragment ttl_limit: 5 Fragment Problems: 0 Stream4 config: Stateful inspection: ACTIVE Session statistics: INACTIVE Session timeout: 30 seconds Session memory cap: 8388608 bytes State alerts: INACTIVE Evasion alerts: INACTIVE Scan alerts: ACTIVE Log Flushed Streams: INACTIVE MinTTL: 1 TTL Limit: 5 Async Link: 0 State Protection: 0 Self preservation threshold: 0 Self preservation period: 0 Suspend threshold: 0 Suspend period: 0 Stream4_reassemble config: Server reassembly: INACTIVE Client reassembly: ACTIVE Reassembler alerts: ACTIVE Ports: 21 23 25 53 80 110 111 143 513 1433 Emergency Ports: 21 23 25 53 80 110 111 143 513 1433 http_decode arguments: Unicode decoding IIS alternate Unicode decoding IIS double encoding vuln Flip backslash to slash Include additional whitespace separators Ports to decode http on: 80 rpc_decode arguments: Ports to decode RPC on: 111 32771 alert_fragments: INACTIVE alert_large_fragments: ACTIVE alert_incomplete: ACTIVE alert_multiple_requests: ACTIVE telnet_decode arguments: Ports to decode telnet on: 21 23 25 119 Conversation Config: KeepStats: 0 Conv Count: 32000 Timeout : 60 Alert Odd?: 0 Allowed IP Protocols: All Portscan2 config: log: /var/log/snort/scan.log scanners_max: 3200 targets_max: 5000 target_limit: 5 port_limit: 20 timeout: 60 Opening /var/log/snort/snort.log.1047064436 ERROR: cannot open raw socket for libnet, exiting... Fatal Error, Quitting.. ## End LogAny ideas? I have a feeling it's something with flexresp and libnet. I'm using Libnet 1.0.2a
-- ------------------------------------------------ | Northern Indiana Educational Services Center | ------------------------------------------------ | Adam Kennedy - akennedy () niesc k12 in us | | Certified Linux Administrator - Master Level | | Phone: (574) 254-0111 x113 | | Fax: (574) 254-0148 | ------------------------------------------------ -------------------------------------------------------This SF.net email is sponsored by: Etnus, makers of TotalView, The debugger for complex code. Debugging C/C++ programs can leave you feeling lost and disoriented. TotalView can help you find your way. Available on major UNIX and Linux platforms. Try it free. www.etnus.com
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort problems Adam Kennedy (Mar 06)
- Re: Snort problems Erick Mechler (Mar 06)
- Re: Snort problems Erek Adams (Mar 06)
- Re: Snort problems Adam Kennedy (Mar 07)
- Re: Snort problems Adam Kennedy (Mar 10)
- Re: Snort problems Erek Adams (Mar 10)
- Bandwidth measurements and correlations Gordon Cunningham (Mar 10)
- logging traffic volume (was Re: Bandwidth measurements and correlations) Bennett Todd (Mar 11)
- RE: Bandwidth measurements and correlations Jan van den Berg (Mar 12)
- Re: Snort problems Jeff Nathan (Mar 11)
- Re: Snort problems Adam Kennedy (Mar 11)
- Re: Snort problems SOLVED Adam Kennedy (Mar 11)
- Re: Snort problems Adam Kennedy (Mar 07)