RE: Errors when initiating my sensors.

["Wirth, Jeff" <WirthJe () DNB com>]

From: Vadim Pushkin [mailto:wiskbroom () hotmail com]
> obsd30# May  1 10:33:06 snort1 snort: FATAL ERROR: ERROR: 
> OpenPcap() device 
> eth1
> open:   /dev/bpf8: Device not configured
> May  1 10:33:06 snort1 snort: FATAL ERROR: ERROR: OpenPcap() 
> device eth1 
> open:
> /dev/bpf8: Device not configured

When *BSD is installed (this is true for FreeBSD, so I am assuming it's true
for OpenBSD) only 4 bpf devices are configured.../dev/bpf0 thru /dev/bpf3.
Guessing by your error you currently have /dev/bpf0 thru /dev/bpf7? So you
need to add another bpf device.

This works for FreeBSD (OpenBSD milage may vary..)

# su -
# cd /dev
# ./MAKEDEV bpf8

> The above is an error that I get when I try to startup snort on a box
> with five sensors. I just upgraded from 1.8.3 to 1.8.6 and I did not
> have this problem under 1.8.3. Any ideas as to what is missing and
> or broken?
>
> I am running on OpenBSD 3.0 and pushing data to a MySQL server, both
> mysql and openbsd boxes have been upgraded.

- Jeff