Re: DAQ and ppp

[Michael Altizer <maltizer () sourcefire com>]

AFPacket currently only supports devices of the ARPHRD_ETHER (1) device 
type.  ppp devices are ARPHRD_PPP (512).

On 12/07/2012 01:07 PM, James Lay wrote:
> Quick question...trying to run:
>
> sudo snort --daq afpacket -c intsnort.conf -i eth0:ppp0
>
> And I get:
>
> ERROR: Can't start DAQ (-1) - start_instance: invalid interface type
> for device ppp0: 512 != 1!
>
> This is 2.9.3.1.  Any hints on what this could be?  Cursory google
> wasn't fruitful.  Thanks all!
>
> James
>
> ------------------------------------------------------------------------------
> LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial
> Remotely access PCs and mobile devices and provide instant support
> Improve your efficiency, and focus on delivering more value-add services
> Discover what IT Professionals Know. Rescue delivers
> http://p.sf.net/sfu/logmein_12329d2d
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!


------------------------------------------------------------------------------
LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial
Remotely access PCs and mobile devices and provide instant support
Improve your efficiency, and focus on delivering more value-add services
Discover what IT Professionals Know. Rescue delivers
http://p.sf.net/sfu/logmein_12329d2d
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!