Re: snort causes "modprobe: can't locate.." in syslog

[John Sage <jsage () finchhaven com>]

Kiira:

Sometimes I'm starting a second process, yes, and sometimes not.

My main snort process starts when ppp0 comes up, and exits when ppp0 
goes down, and again, it's logging *everything*.

Then later I look at what was logged with the second process, with a 
more complex ruleset.

So sometimes I'm running the second instance when ppp0 is up and there's 
another instance of snort, and sometimes not. (Actually, when I was 
using 1.7 all this other stuff happened on another box entirely...)

I think you're on the right track though, this has got something to do 
with how snort 1.8.1-b4 sees (or wants to see..) ppp0 or $HOME_NET or 
something like that.

Thanks for bringing up the ppp0 idea -- that's what I'm going to look at 
next.

- John

Kiira Triea wrote:

> Hi, 
>
>
> > I've narrowed down the syslog message ("modprobe: Can't locate module
> > [reading from a   ") created by snort 1.8.1.beta4, to its being generated
> > when I run a secondary set of rules against all packets logged over an
> > extended period of time by my primary rule sets.
> > The primary rules binary-log *everything* and do just a little alerting
> > for some specific ports - nothing fancy.
> >
> > The secondary ruleset is basically the box-stock snort.conf that comes
> > with 1.8.1-beta4 and the *-rules that come with beta 4...
> >
> >
> > So what about all this is trying to locate a module?
>
> Just wondering if I understand this... are you starting up a second
> snort process with a second group of alerts to look at ppp0 traffic?
> Since the syslog message is from modprobe, do you have ppp configured
> as a module? - it's probably better to build monolithic kernels for
> security work (I think in general also).
>
> Maybe a second snort process makes the kernel try and load ppp0 
> module a second time? 
>
> Kiira - JTTBH(D) (just trying to be helpful(doubtfully))




--
John Sage
FinchHaven, Vashon Island, WA, USA
http://www.finchhaven.com/
mailto:jsage () finchhaven com
"The web is so, like, five minutes ago..."


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users