Re: OpenPcap() error

[Erek Adams <erek () snort org>]

On Tue, 18 Mar 2003, Robert Cole wrote:

> OpenPcap() errors go back years as I stated. A search on google for OpenPcap()
> turned up years worth of unanswered posts to the exact error I'm talking
> about.
>
> I'll post all my info and detailed logs on this problem shortly. It's snort
> 1.9.1 I'm talking about but since this error goes back years it doesn't
> appear to make a difference. That's why I didn't bother with a while lot the
> first time. It's extensively documented through 100s of posts over the past 3
> years with no answers.
>
> But in the mean time I can start snort from the command line with params but
> when I try to use the snort.conf file I get the openpcap() error.
>
> There is an faq on snort.org but it references the windows version only.
>
> Thank you for your reply and I'll post the requested info shortly.

I'll bet your command line is something like the following:

        snort <some options> -s <some other options>

Due to a fix that was added, then partially 'lost', -s can have a
parameter.  Going out on a limb--Change the command line so that -s is the
last parameter in the list.

        snort <all other options> -s

And you should be fine.

You might want to consider:

        output alert_syslog: LOG_AUTH LOG_ALERT

In your snort.conf instead of using -s.

Again, I'm guessing...  :)

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


-------------------------------------------------------
This SF.net email is sponsored by: Does your code think in ink? 
You could win a Tablet PC. Get a free Tablet PC hat just for playing. 
What are you waiting for?
http://ads.sourceforge.net/cgi-bin/redirect.pl?micr5043en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users