Snort OpenPcap error

[Bosco Tsang]

I am trying to run Snort but have the following error. There should be no other application running/using OpenPcap and in fact, I've just install libpcap right before installing snort. Any idea what happen? and how can I make it to work?

--
Sep 6 09:35:28 syslog: Initializing daemon mode
Sep 6 09:35:28 syslog: FATAL ERROR: ERROR: OpenPcap() device lan0 open:

[Ron Kinner]

There should be more to the error message. It's not necessarily telling you that OpenPcap() or lan0 is in use - just that OpenPcap() had a problem trying to open lan0. Maybe you need to turn on debug to see all of it?

There are two errors mentioned on the web:

recv_ack: promisc_phys: Invalid argument

"if you run snort and receive the error message
"ERROR: OpenPcap() device lan0 open:
recv_ack: promisc_phys: Invalid argument"
it's because there's another program running using the DLPI service.
The HP-UX implementation doesn't allow more than one libpcap program
at a time to run, unlike Linux."

can't find PPA for /dev/lan0

http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&threadm=3A06E84C.2000109%40rsn.hp.com&rnum=1&prev=/groups%3Fhl%3Den%26lr%3D%26ie%3DUTF-8%26oe%3DUTF-8%26q%3D%2522OpenPcap()%2Bdevice%2Blan0%2Bopen%2522%26sa%3DN%26tab%3Dwg



Ron

[Bosco Tsang]

How can I turn on debug? There is no such option. The following is the additional error when I run snort. The libpcap library is the latest already. Any idea what happen?

--== Initializing Snort ==--
Decoding Ethernet on interface lan0
Initializing Preprocessors!
Initializing Plug-ins!
Initializating Output Plugins!
Parsing Rules file /usr/local/etc/snort.conf

+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
No arguments to frag2 directive, setting defaults to:
Fragment timeout: 60 seconds
Fragment memory cap: 4194304 bytes
Stream4 config:
Stateful inspection: ACTIVE
Session statistics: INACTIVE
Session timeout: 30 seconds
Session memory cap: 8388608 bytes
State alerts: INACTIVE
Scan alerts: ACTIVE
Log Flushed Streams: INACTIVE
Bus error(coredump)

[Ron Kinner]

You have to recompile to get debug on:

: get some more diagnostic information and post it to "snort-users" at
http://www.sourceforge.net

To get diagnostic information compile snort as either:

make clean; make CFLAGS=-ggdb

or
make clean; make "CFLAGS=-ggdb -DDEBUG"

trace coredump as:

gdb /path/to/snort /path/to/snort/core

gdb> where
gdb> bt
gdb> print $varname, varname, $$varname etc..

or if corefile isn't generated snort should be started as

gdb snort

gdb> run


Above from the snort faq.

http://www.snort.org/docs/#setup

Ron

[U.SivaKumar_2]

Hi,
After Installing libpcap , Have you rebooted the server ?

regards,
U.SivaKumar

[rick jones]

installation of libpcap should not require a system reboot - libpcap is just user-space code under HP-UX.

i'd verify that the latest version of libpcap is on the system - going back a ways there were problems with libpcap when Auto Port Aggregation was installed - it make a return larger tha libpcap was expecting.

once the latest revision of libpcap is installed, try it with tcpdump to get some data along a slightly different axis.


just a random though - are you running as root, or something else?