[prev in list] [next in list] [prev in thread] [next in thread] 

List:       snort-announce
Subject:    [Snort-announce] run snort on GRE tunnel interface?
From:       Andreas Dembach <dembaca () kopernikus ! de>
Date:       2001-06-26 16:35:01
[Download RAW message or body]

Hi,

snort version 1.7 SEGFAULTS if told to listen on a GRE tunnel interface:

-----------------------
# snort -h xx.xx.xx.xx/24 -c /etc/snort/snort.conf 
-S"HOME_NET=xx.xx.xx.xx/24"     -l /var/log/snort -b -d -u snort -g snort 
-s -i gre0
Initializing Network Interface gre0
Warning: arptype 778 not supported by libpcap - falling back to cooked 
socket

snort cannot handle data link type 113
Exiting...
Segmentation fault
#
-------------------------------

Is this a snort problem or one of libpcap? tcpdump complains (but works 
anyway):

>Warning: arptype 778 not supported by libpcap - falling back to cooked 
socket
>tcpdump: listening on gre0

Im am running on linux with a 2.2.17 kernel and libpcap0 0.6.2-1

Any ideas or comments?

Andreas Dembach


_______________________________________________
Snort-announce mailing list
Snort-announce@lists.sourceforge.net
http://lists.sourceforge.net/lists/listinfo/snort-announce

[prev in list] [next in list] [prev in thread] [next in thread]