Re: Snort 2.9.5 / PFRing

[Russ Combs <rcombs () sourcefire com>]

On Thu, Jul 25, 2013 at 8:50 PM, Welters, Jon (LARC-B703)[LITES] <
jonathan.a.welters () nasa gov> wrote:

>  All,****
>
> ** **
>
> I’ve been running snort with pfring for some time now successfully and
> haven’t had many problems. Yesterday I compiled Snort 2.9.5 on our test box
> using the same flag I always have –prefix=/usr/local/snort-2.9.5 then I
> started snort as usual and it sees packets flowing through and drops 100%.
> ****
>
> ** **
>
> Since we retain the old installations and just repoint a symlink I went
> ahead and pointed back to the old release, which worked fine. I then went
> ahead and compiled the newest PFRing, tested with 2.9.5 to find that it
> still wasn’t working. Switched back to 2.9.4 with the same configuration
> and it worked. The only thing that changed was the compiled snort, pfring
> remained the same ****
>
> ** **
>
> I double checked the config log and in 2.9.4 I did not add any flags other
> then the prefix. ****
>
> ** **
>
> Has anyone else experienced this sort of issue ?

Which PF_RING DAQ version do you have?  There was an incompatibility with
2.9.5 Snort fixed with the 5.6.0 PF_RING available here:
http://sourceforge.net/projects/ntop/files/PF_RING/.

> ****
>
> ** **
>
> **-          **Jon****
>
> ** **
>
>
> ------------------------------------------------------------------------------
> Get your SQL database under version control now!
> Version control is standard for application code, but databases havent
> caught up. So what steps can you take to put your SQL databases under
> version control? Why should you start doing it? Read more to find out.
> http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
------------------------------------------------------------------------------
Get your SQL database under version control now!
Version control is standard for application code, but databases havent 
caught up. So what steps can you take to put your SQL databases under 
version control? Why should you start doing it? Read more to find out.
http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!