Re: Compiling and Running Snort 2.9.8.0 on MAC OSX 10.11.3 (El Capitan)

["Joel Esler (jesler)" <jesler () cisco com>]

I don’t think that the interface would be called “eth0” on a mac.  You may want to make sure you have the right device 
specified.

--
Joel Esler
Manager, Talos Group




On Feb 12, 2016, at 5:04 PM, Madhu Rao <k.madhurao.123 () gmail com<mailto:k.madhurao.123 () gmail com>> wrote:

Hi Folks

Has anyone had Luck downloading and compiling snort 2.9.8.0 and get it working on Latest MAC OS X El Capitan ?
I have a macbook pro running El Capitan. (OSX 10.11.3)

I See the following Errors when I run Snort.


$ sudo snort -c /etc/snort/snort.conf --daq pcap --daq-mode passive -i eth0 -k none

pcap DAQ configured to passive.

Acquiring network traffic from "eth0".

Reload thread starting...

Reload thread started, thread 0x700000081000 (41553)

ERROR: Can't start DAQ (-1) - BIOCSETIF failed: Device not configured!


Fatal Error, Quitting..


BTW - when I configured DAQ, this was the outcome.


$cd daq-2.0.6

./configure --disable-afpacket-module

...

Build AFPacket DAQ module.. : no
Build Dump DAQ module...... : yes
Build IPFW DAQ module...... : yes
Build IPQ DAQ module....... : no
Build NFQ DAQ module....... : no
Build PCAP DAQ module...... : yes
Build netmap DAQ module.... : no


Any pointers appreciated.

-- madhu


------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=272487151&iu=/4140_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!

------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=272487151&iu=/4140

_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!