Home page logo
/

snort logo Snort mailing list archives

Re: Barnyard2 issue w/unified2 ?
From: John Ives <jives () security berkeley edu>
Date: Thu, 15 Aug 2013 08:52:19 -0700

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Jeff,

My understanding from my own research is that for each instance of
snort on a system there needs to be an instance of barnyard2 each with
its own configuration file. Supposedly, that is all that is needed.
However, I have not been able to make it work as all but one of the
barnyards will eventually crash. Unfortunately, I have not had enough
time look for a fix, since moving to fewer systems running pf_ring
instead of a cluster of systems is a roadmap project. I will, however
be watching this thread with interest.

John

On 8/13/2013 6:11 PM, Jeff Kell wrote:
On 8/13/2013 6:38 PM, Weir, Jason wrote:
I've experienced this issue when I mistakenly start a second
barnyard process without killing the original first.

Make sure you only have 1 barnyard process running on each box

OK, so how do you run multiple instances (connection-multiplexed
PF_RING instances) without having multiple barnyard2 instances?

Jeff



------------------------------------------------------------------------------


Get 100% visibility into Java/.NET code with AppDynamics Lite!
It's a free troubleshooting tool designed for production. Get down
to code-level detail for bottlenecks, with <2% overhead. Download
for free and get started troubleshooting in minutes. 
http://pubads.g.doubleclick.net/gampad/clk?id=48897031&iu=/4140/ostg.clktrk




_______________________________________________ Snort-users mailing
list Snort-users () lists sourceforge net Go to this URL to change
user options or unsubscribe: 
https://lists.sourceforge.net/lists/listinfo/snort-users 
Snort-users list archive: 
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

 Please visit http://blog.snort.org to stay current on all the
latest Snort news!



- -- 
- -------------------------------------------------------------------------
John Ives
System & Network Security                           Phone (510) 229-8676
University of California, Berkeley
- -------------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (MingW32)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBAgAGBQJSDPkzAAoJEJkidK6qbywsKfMIALXR4mnGia9Q+EpnfLPC/3w6
4XZ1tUVmsQ/y9+IsuIFiMijhZR79TBOMmsUVRg2mDxJSxND/2aIj/jXM2uFGMkj7
uQocHVN6rZftWzg89/pc4o2MRLfjUo2ltsoeqtJp3rpWqqPG8hGyXExSwBvyNXU7
heq6Sj6L5P1vVULWzKlJG3IiI+CKYce1G3eBfk5whRfXgnJu4M4HHeYBNH0e8OJs
7vCXt4lXPQ7WYwR7Fv20+qS0I6PpTAzu09ZDqOtsS90YZcrvjokz6pm7NTmvRxWE
NhFK4drQk/xkM8f0Ed8qN6ZNUGO+oBEi0tyFZM7OXJ16chv9+86ULqlH3bAEUQY=
=51dm
-----END PGP SIGNATURE-----

------------------------------------------------------------------------------
Get 100% visibility into Java/.NET code with AppDynamics Lite!
It's a free troubleshooting tool designed for production.
Get down to code-level detail for bottlenecks, with <2% overhead. 
Download for free and get started troubleshooting in minutes. 
http://pubads.g.doubleclick.net/gampad/clk?id=48897031&iu=/4140/ostg.clktrk
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault