NIDS on large (>500MB) pcap dumps

[Steve Marotta <smarotta () cra com>]

Hi,

Is there a way to run Snort in NIDS mode on large (>500MB) pcap dumps? When I try to run snort -dev -l (mylog) -r 
(myfile) -c /etc/snort.conf, I get, "Value too large for defined data type" and "ERROR: Error getting pcaps".

Is this because the file I'm reading is too large? If so, is there a workaround?






THIS MESSAGE IS INTENDED FOR THE USE OF THE PERSON TO WHOM IT IS ADDRESSED. IT MAY CONTAIN INFORMATION THAT IS 
PRIVILEGED, CONFIDENTIAL AND EXEMPT FROM DISCLOSURE UNDER APPLICABLE LAW. If you are not the intended recipient, your 
use of this message for any purpose is strictly prohibited. If you have received this communication in error, please 
delete the message and notify the sender so that we may correct our records.






------------------------------------------------------------------------------
LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial
Remotely access PCs and mobile devices and provide instant support
Improve your efficiency, and focus on delivering more value-add services
Discover what IT Professionals Know. Rescue delivers
http://p.sf.net/sfu/logmein_12329d2d
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!