Re: snort causes "modprobe: can't locate.." in syslog

[Kiira Triea <kiira-t () mail bsasinc org>]

Hi, 

> I've narrowed down the syslog message ("modprobe: Can't locate module
> [reading from a   ") created by snort 1.8.1.beta4, to its being generated
> when I run a secondary set of rules against all packets logged over an
> extended period of time by my primary rule sets.
> The primary rules binary-log *everything* and do just a little alerting
> for some specific ports - nothing fancy.
>
> The secondary ruleset is basically the box-stock snort.conf that comes
> with 1.8.1-beta4 and the *-rules that come with beta 4...
>
>
> So what about all this is trying to locate a module?

Just wondering if I understand this... are you starting up a second
snort process with a second group of alerts to look at ppp0 traffic?
Since the syslog message is from modprobe, do you have ppp configured
as a module? - it's probably better to build monolithic kernels for
security work (I think in general also).

Maybe a second snort process makes the kernel try and load ppp0 
module a second time? 

Kiira - JTTBH(D) (just trying to be helpful(doubtfully))


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users