snort Version 2.8.6.rc (Build 16), option -r large.pcap, ... Value too large for defined data type

[Phil Wood <cpw () lanl gov>]

Folks,

Not a real big deal.  But ...

Error getting stat on pcap file: /data/1266949500.000024.pcap: Value too large for defined data type
ERROR: Error getting pcaps.
Fatal Error, Quitting..

# this file is 5 minutes worth of pcap
$ ls -l /data/1266949500.000024.pcap
-rw-rw-r-- 1 grok grok 10429540832 2010-02-23 11:30 /data/1266949500.000024.pcap

$ /etc/snort/snort -V

   ,,_     -*> Snort! <*-
  o"  )~   Version 2.8.6.rc (Build 16)  
   ''''    By Martin Roesch & The Snort Team:
http://www.snort.org/snort/snort-team
           Copyright (C) 1998-2010 Sourcefire, Inc., et al.
           Using PCRE version: 7.8 2008-09-05

Not a big deal, I can get around the problem by piping pcap files to
snort.  But, it seams reasonable to expect that snort could read large
files.  Maybe I just need to know the right configuration option when
building it, or there is an option I don't see off the bat, or there is
another release out!

Later,

-- 
C. Philip Wood, Int. D.
Senior Member of the Internet
Los Alamos National Laboratory
Key fingerprint: 2BB7 A990 44F5 EF4B 4E35  8635 1205 97D3 F6D8 7F39
E-mail: cpw () lanl gov, cornett () arpa net
Phone: 505 667-2598

Attachment: signature.asc
Description: This is a digitally signed message part

------------------------------------------------------------------------------
Download Intel® Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev

_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel