Strange system() problem with snort

["Mark Wormgoor" <mark () wormgoor com>]

Guys,

I have a small problem with starting snort from another program.  I'm
running snort 1.8.3 (from RPM) on a Redhat 7.2 based system.

When I start snort from the command line, it will start just fine:
/usr/sbin/snort -c /etc/snort/snort.conf -D -u snort -g snort -d -e -z
ALL -A fast -m 022 -i ppp0
  Dec 30 09:51:42 ipcop kernel: device ppp0 entered promiscuous mode
  Dec 30 09:51:42 ipcop snort: PID stat checked out ok, PID set to /var/run/
  Dec 30 09:51:42 ipcop snort: Writing PID file to "/var/run/"
  Dec 30 09:51:42 ipcop snort: Initializing daemon mode
  Dec 30 09:51:42 ipcop snort: PID stat checked out ok, PID set to /var/run/
  Dec 30 09:51:42 ipcop snort: Writing PID file to "/var/run/"
  Dec 30 09:51:42 ipcop snort: There's no second layer header available for
this datalink
  Dec 30 09:51:47 ipcop snort: Snort initialization completed successfully,
Snort running

When I start snort from another program, it dies.  The important line here
is 'device ppp0 left promiscuous mode'.  Why is it leaving promiscuous mode
so soon after I start it?
system("/usr/sbin/snort -c /etc/snort/snort.conf -D -u snort -g
snort -d -e -z ALL -A fast -m 022 -i ppp0");
  Dec 30 09:51:17 ipcop kernel: device ppp0 entered promiscuous mode
  Dec 30 09:51:17 ipcop snort: PID stat checked out ok, PID set to /var/run/
  Dec 30 09:51:18 ipcop snort: Writing PID file to "/var/run/"
  Dec 30 09:51:18 ipcop snort: Initializing daemon mode
  Dec 30 09:51:18 ipcop kernel: device ppp0 left promiscuous mode
  Dec 30 09:51:18 ipcop snort: PID stat checked out ok, PID set to /var/run/
  Dec 30 09:51:18 ipcop snort: Writing PID file to "/var/run/"
  Dec 30 09:51:18 ipcop snort: There's no second layer header available for
this datalink
  Dec 30 09:51:23 ipcop snort: Snort initialization completed successfully,
Snort running
  Dec 30 09:51:23 ipcop snort: pcap_loop: recvfrom: Socket operation on
non-socket
  Dec 30 09:51:23 ipcop snort: Snort received signal 3, exiting

Kind regards,


        Mark Wormgoor

***************************************************************
* |\    /|      |  /|  /       Mark Wormgoor                  *
* | \  / |      | / | /        mailto:mark () wormgoor com       *
* |  \/  |ark   |/  |/ormgoor  http://www.wormgoor.com/mark/  *
***************************************************************


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users