Re: XP / Snort / Error opening device

["Chris Reid" <Chris.Reid () CodeCraftConsultants com>]

This is a known problem with older versions of winpcap.  It is a buffer
overflow which happens when you have a large number of interfaces defined
(ie. network cards, VPN, PPP, etc).  The version of Snort you mentioned
probably has an older winpcap compiled into it.  The current winpcap source
has increased the size of this buffer (from 1K to 8K), so it is much less
likely to occur.  More recent releases of Snort use the newer version of
winpcap.

The most recent relase for Win32 on snort.org is 1.8.5.  However, newer
releases for Win32 are available from silicondefense.com
(http://www.silicondefense.com/techsupport/downloads.htm).

Or, if you have Visual Studio, and want to compile you own executable, you
can download the source code.  Note that you will probably want to get
version 1.8.6 or 1.8.7.

Chris Reid


----- Original Message -----
From: "Robert Spinelli" <rspinell () earthlink net>
To: <snort-users () lists sourceforge net>
Sent: Sunday, June 30, 2002 10:47 AM
Subject: [Snort-users] XP / Snort / Error opening device


> I have searched the archive and haven't seen a solution for this problem
> yet.
>
> I am getting the following error:
>
> ERROR: OpenPcap() device  open:
>         Error opening adapter
> Fatal Error, Quitting..
>
> Does anyone know how to fix this ?  I am running Snort v1.85 on Windows
> XP with WinPcap v 2.3. I have used Windump to verify that WinPCap is
> working, and that works fine.  I also have done snort -W and get the
> following info:
>
>
> Interface       Device          Description
> -------------------------------------------
> 1
>
> It only shows 1 interface with no name or description.
>
> I hope someone has an answer.
>
> Thanks
>
> Rob
>
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users




-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users