Re: Starting Snort Errors-Fedora3

[James Riden <j.riden () massey ac nz>]

Mark Sargent <powderkeg () snow email ne jp> writes:

> [root@localhost ~]# snort -i eth0 -dev /var/logs/snortlogs/snort
> Running in packet dump mode Initializing Network Interface eth0 ERROR:
> OpenPcap() FSM compilation failed: syntax error PCAP command:
> /var/logs/snortlogs/snort Fatal Error, Quitting.. Little lost. Can
> someone direct to where I should be.? Cheers.

If you're trying to specify a logging directory, you'll need -l, so
try:

# snort -i eth0 -dev -l /var/logs/snortlogs/snort

Otherwise the string at the end of your command will be interpreted as
a tcpdump-type filter. (An interface name is typically 'eth0', 'eth1'
etc. and not an IP address such as 192.168.1.1)

cheers,
 Jamie
-- 
James Riden / j.riden () massey ac nz / Systems Security Engineer
Information Technology Services, Massey University, NZ.
GPG public key available at: http://www.massey.ac.nz/~jriden/




-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users