Snort mailing list archives

Snort dies


From: "Pablo Venini" <pvenini () mervaros com ar>
Date: Tue, 23 May 2006 12:03:24 -0300

Hi, I'm doing my first snort installation. I installed it without problems and configured it to log alerts via syslog.  
Everything seems OK, but after running  for a while it dies, sending the following message to syslog:

May 23 10:49:39 localhost kernel: eth0.7: dev_set_promiscuity(master, -1)
May 23 10:49:39 localhost kernel: device eth0.7 left promiscuous mode

This seems to occur whenever the following traffic is detected

May 23 10:49:39 localhost snort[8729]: [119:15:1] (http_inspect) OVERSIZE REQUEST-URI DIRECTORY <eth0.7> {TCP} 
xxx.xxx.xxx.xxx:59635 -> xxx.xxx.xxx.xxx:80

This traffic originates in my internal network and goes to MSN services like Hotmail and WebMessenger.

I'm using Snort 2.4.4 with the current ruleset, running on a Red Hat Linux box with kernel version 2.4.20-8. I'm also 
using logsurfer to scan the syslog file and send alerts via mail. The NIC is an Intel PRO1000 GT with VLAN suport 
enabled in the kernel; it has 7 subinterfaces but I'm running snort in only one of them. The box is also running 
tcpdump in another subinterface.

Current thread: