Re: OpenPcap() error

[Robert Cole <robert.cole () support4linux com>]

>       snort -c /etc/snort/snort.conf


Close here's the first attempt:

Mar 18 10:21:13 logger device eth0 entered promiscuous mode
Mar 18 10:21:13 logger snort: WARNING: OpenPcap() device eth0 network lookup:   
eth0: no IPv4 address assigned
Mar 18 10:21:13 logger snort: ERROR snort(10) => Group "(null)" unknown
Mar 18 10:21:13 logger device eth0 left promiscuous mode

I then edited the /etc/snort/snort.conf file to comment out the set_uid and 
set_gid

I'm going to try the numbers next to see if that works. If not are these 
config params broken in 1.9.1?

Then I got:

Mar 18 10:22:17 logger device eth0 entered promiscuous mode
Mar 18 10:22:17 logger snort: WARNING: OpenPcap() device eth0 network lookup:   
eth0: no IPv4 address assigned
Mar 18 10:22:17 logger snort: FATAL ERROR: ERROR /etc/snort/snort.conf:19 => 
Port value missing in rule!
Mar 18 10:22:17 logger device eth0 left promiscuous mode

What do you suppose is wrong with:

log udp 192.168.0.12/32 -> 192.168.0.111/32 514 (logto:"ws1.log";)

?? I checked the manual on this and page 9 of the 1.9.1 manual shows the port 
number that way. The rest seems ok to me. Any ideas?

Thanks


-------------------------------------------------------
This SF.net email is sponsored by: Does your code think in ink? 
You could win a Tablet PC. Get a free Tablet PC hat just for playing. 
What are you waiting for?
http://ads.sourceforge.net/cgi-bin/redirect.pl?micr5043en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users