Re: snort 2.02 cant start automactically

[James Riden <j.riden () massey ac nz>]

"th0ri4.wang" <th0ri4 () yahoo com cn> writes:

>    hi,
>
>
>
>    i have a debian woody box,  i have copied the file S99snort to
>    /etc/init.d/snort,and create a symbol link at rc3.d. then i
>
>    reboot my box, the following lines traped me:
>
>    ----------------------------------------------------------------------
>    ----------------------------------
>
>    Aug 23 18:15:29 andreas kernel: TCP: Hash tables configured
>    (established 4096 b
>    nd 4096)
>    Aug 23 18:15:29 andreas kernel: NET4: Unix domain sockets 1.0/SMP for
>    Linux NET
>    .0.
>    Aug 23 18:15:29 andreas kernel: ds: no socket drivers loaded!
>    Aug 23 18:15:29 andreas kernel: VFS: Mounted root (ext2 filesystem)
>    readonly.
>    Aug 23 18:15:29 andreas kernel: Freeing unused kernel memory: 188k
>    freed
>    Aug 23 18:15:29 andreas kernel: Adding Swap: 771048k swap-space
>    (priority -1)
>    Aug 23 18:15:32 andreas kernel: eth0: Promiscuous mode enabled.
>    Aug 23 18:15:32 andreas kernel: device eth0 entered promiscuous mode
>    Aug 23 18:15:33 andreas kernel: device eth0 left promiscuous mode
>
>    ----------------------------------------------------------------------
>    -----------------------------------
>
>    when the script get snort start, it immediately down and left
>    promiscuous mode, but  when i use this command:

What does it say in /var/log/messages ? 

eg.  this is part of a successful start up - yours might be 'snort'
instead of 'snort-pgsql':

Aug 31 03:58:03 it023072 snort-pgsql:     alert_large_fragments: ACTIVE
Aug 31 03:58:03 it023072 snort-pgsql:     alert_incomplete: ACTIVE
Aug 31 03:58:03 it023072 snort-pgsql:     alert_multiple_requests: ACTIVE
Aug 31 03:58:03 it023072 snort-pgsql: telnet_decode arguments:
Aug 31 03:58:03 it023072 snort-pgsql:     Ports to decode telnet on: 21 23 25 119
Aug 31 03:58:03 it023072 postgres[5595]: [1] LOG:  connection received: host=130.123.107.157 port=36152
Aug 31 03:58:03 it023072 postgres[5595]: [2] LOG:  connection authorized: user=snort_db_user database=snort
Aug 31 03:58:05 it023072 snort-pgsql: Warning: flowbits key 'realplayer.playlist' is checked but not ever set.
Aug 31 03:58:05 it023072 snort-pgsql: Snort initialization completed successfully

cheers,
 Jamie
-- 
James Riden / j.riden () massey ac nz / Systems Security Engineer
Information Technology Services, Massey University, NZ.
GPG public key available at: http://www.massey.ac.nz/~jriden/



-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users