Re: Problems with Snort on SuSE Linux 9.1 (Kernel 2.6)

["Eric Hines" <eric.hines () appliedwatch com>]

MessageTom,

There was a thread started by someone on the SuSE-security mailing list that no one provided a response to. 
http://lists.suse.com/archive/suse-security/2004-May/0143.html

I was wondering if someone on the snort-users list knew of a bug in 2.1.1 Snort that prevented it from working on a 2.6 
kernel or SuSE 9.1.

The biggest question to our engineers so far is whether its a bug in Snort or pcap. 

Eric Hines, GCIA, CISSP
CEO, President
Applied Watch Technologies, Inc.
http://www.appliedwatch.com

  ----- Original Message ----- 
  From: Tom Fulton 
  To: 'Eric Hines' ; snort-users () lists sourceforge net 
  Sent: Thursday, June 10, 2004 6:42 PM
  Subject: RE: [Snort-users] Problems with Snort on SuSE Linux 9.1 (Kernel 2.6)


  Let me see if I can find anything out on this on the internal websites.  I'm not currently running this combination.

  Tom Fulton, CISSP
  Sr. Systems Engineer
  Novell/SuSE Linux
  San Jose, CA
  Mobile: 408-802-0948 (Primary)
   
    

    -----Original Message-----
    From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of 
Eric Hines
    Sent: Thursday, June 10, 2004 5:28 PM
    To: snort-users () lists sourceforge net
    Subject: [Snort-users] Problems with Snort on SuSE Linux 9.1 (Kernel 2.6)


    All,

    We are having customers reporting Snort 2.1.1 not working on SuSE Linux 9.1. When trying to start Snort, they 
report a Fatal Error message from pcap.

    Is anyone aware of a bugfix that may have been made in 2.1.1 -> 2.1.3? Or has anyone on this list seen the same 
problems when using SuSE 9.1, kernel 2.6 and Snort?

    Is it a problem introduced with the 2.6 kernel in Snort or is it pcap?

    Thanks,

    Eric Hines
    CEO, President
    Applied Watch Technologies, Inc.
    http://www.appliedwatch.com