Snort mailing list archives

Issues with sfip_fast_lt6 on Raspberry Pi


From: Jon Frydensbjerg via Snort-devel <snort-devel () lists snort org>
Date: Sun, 15 Nov 2020 14:42:25 +0100

Hi,

I'm now successfully running snort 2.9.16.1 in IPS mode using the nfq DAQ on a Raspberry Pi 4 compiled for 32-bit ARM via GCC 8.3.

Initially it didn't work well for me as I would lose all network connectivity immediately after Snort had loaded. After debugging the problem I narrowed the issue down to changes in the sfip_fast_lt6() function of src/sfutil/sf_ip.h (it was modified between 2.9.15.1 and 2.9.16).

However, when I switch back to the old version from 2.9.15.1 everything is working great. For now I've patched my local installation by simply making a copy of the old function code.

Unfortunately I don't have the time to dig deeper into this. It's not clear to me from a quick glance why the 2.9.16 version of sfip_fast_lt6() doesn't work.

Cheers,

-Jon

_______________________________________________
Snort-devel mailing list
Snort-devel () lists snort org
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!


Current thread: