Snort mailing list archives
Re: OpenPcap() error
From: Erek Adams <erek () snort org>
Date: Tue, 18 Mar 2003 13:35:33 -0500 (EST)
On Tue, 18 Mar 2003, Robert Cole wrote:
Close here's the first attempt: Mar 18 10:21:13 logger device eth0 entered promiscuous mode Mar 18 10:21:13 logger snort: WARNING: OpenPcap() device eth0 network lookup: eth0: no IPv4 address assigned Mar 18 10:21:13 logger snort: ERROR snort(10) => Group "(null)" unknown Mar 18 10:21:13 logger device eth0 left promiscuous mode I then edited the /etc/snort/snort.conf file to comment out the set_uid and set_gid I'm going to try the numbers next to see if that works. If not are these config params broken in 1.9.1?
Do you have those defined in /etc/group and /etc/password /etc/shadow? If so, change them to config set_gid: snort config set_uid: snort See if that makes a difference. [...snip...]
What do you suppose is wrong with: log udp 192.168.0.12/32 -> 192.168.0.111/32 514 (logto:"ws1.log";) ?? I checked the manual on this and page 9 of the 1.9.1 manual shows the port number that way. The rest seems ok to me. Any ideas?
There's no port on the first half of the rule. log udp 192.168.0.12/32 any -> 192.168.0.111/32 514 (logto: \ "ws1.log" ;) All rules must have the following form: <action> <type> <IP> <port> <direction> <IP> <port> More is fine: <action> <type> <IP> <port> <direction> <IP> <port> (<whatever>;) Or not.... :) ----- Erek Adams "When things get weird, the weird turn pro." H.S. Thompson ------------------------------------------------------- This SF.net email is sponsored by: Does your code think in ink? You could win a Tablet PC. Get a free Tablet PC hat just for playing. What are you waiting for? http://ads.sourceforge.net/cgi-bin/redirect.pl?micr5043en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- OpenPcap() error Robert Cole (Mar 17)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Phil Wood (Mar 19)
- Re: OpenPcap() error Robert Cole (Mar 19)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)