Snort error: can't find PPA for /dev/lan0

[Mauro Gatti]

I get this error running snort 1.8.6 on HP-UX 11:

gemini# ./snort -dvi lan0
Log directory = /var/log/snort

Initializing Network Interface lan0
ERROR: OpenPcap() device lan0 open:
can't find PPA for /dev/lan0
Fatal Error, Quitting..


I've installed libpcap 0.5.2.

Anyone could help me?

Thank You

[Paula J Frazer-Campbell]

Hi

Does lanadmin behave OK ?


Paula

[Bill McNAMARA_1]

# lanscan
# ll /dev/lan*

give us the link to snort, I'll try installing it.

[Mauro Gatti]

LAN INTERFACE STATUS DISPLAY
Tue , Sep 17,2002 13:36:23

PPA Number = 0
Description = lan0 HP PCI 10/100Base-TX Core [100BASE-TX,FD,AUTO,TT=1500]
Type (value) = ethernet-csmacd(6)
MTU Size = 1500
Speed = 100000000
Station Address = 0x306e0c8a48
Administration Status (value) = up(1)
Operation Status (value) = up(1)
Last Change = 774
Inbound Octets = 277520679
Inbound Unicast Packets = 108360
Inbound Non-Unicast Packets = 1239483
Inbound Discards = 0
Inbound Errors = 0
Inbound Unknown Protocols = 154649
Outbound Octets = 14964173
Outbound Unicast Packets = 110587
Outbound Non-Unicast Packets = 3359
Outbound Discards = 0
Outbound Errors = 0
Outbound Queue Length = 0
Specific = 655367


gemini# lanscan
Hardware Station Crd Hdw Net-Interface NM MAC HP-DLPI DLPI
Path Address In# State NamePPA ID Type Support Mjr#
0/0/0/0 0x00306E0C8A48 0 UP lan0 snap0 1 ETHER Yes 119

gemini# ll /dev/lan0
crw-rw-rw- 1 bin bin 14 0x000000 Jun 7 04:12 /dev/lan0

[harry d brown jr]

Bill,

http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/snort-1.8.6/

live free or die
harry

[harry d brown jr]

Have you installed openssl???

What are your configuration files??

Are you running 11 or 11i???

32 or 64bit??

live free or die
harry

[Mauro Gatti]

I've downloaded my snort from
http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/snort-1.8.6/ ! :-)

[Mauro Gatti]

I've installed
openssl 0.9.6d
I'm using HP-UX 11i

[rick jones]

the libpcap rev sounds old - i would suggest downloading the latest libpcap from tcpdump.org and using that. i know it has the code to go from ifconfig name to ppa.

older libpcaps for UX you needed to say something like "dlpiN" where N was the PPA. that, or /dev/dlpiN, I cannot remember.

However, do not expect there to be a /dev/dlpiN device file, and do not expect that any existing /dev/dlpiN device file matches an interface at PPA N - it is all just coincidence