Sponsored Content
Top Forums UNIX for Beginners Questions & Answers Snort 2.9.14 hangs once started Post 303037059 by bodisha on Monday 22nd of July 2019 02:56:42 PM
Old 07-22-2019
Snort 2.9.14 hangs once started

I've been trying to get Snort running on my lab network, but haven't been having much luck.

I installed Snort 2.9.14 on both Windows 10 & Ubuntu 18.04 (Running in VirtualBox 5.2.22). I seems to have the snort.conf file set up correctly in both environments, because when I test snort in either one... it exits with a "Snort successfully validated the configuration!" message.

Unfortunately, when I try to start snort out of test mode.... It seems to start and displays the "Commencing packet processing" message... But hangs afterwards... Snort on Ubuntu doesn't show anything after that... But Snort installed on Windows 10 displays "Decoding LoopBack". And doesn't display anything after that.

I've edited the local.rules to display messages if the machine's been pinged or if I view a page with a browser. I have the NIC in promiscuous mode and I'm running the cmd window as an administrator.

Can someone please suggest what might be going on, or a solution? Thanks!

Last edited by bodisha; 07-22-2019 at 04:28 PM..
 

6 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

snort installation on freebsd issues

i'm following the, "How to setup and secure Snort, MySQL and Acid on FreeBSD 4.6 Release" off of the snort.org website. in the documentation it says snort should be installed through the following: ----- make -DWITH_MYSQL -DWITH_FLEXRESP ; make install ----- later it says to do the... (13 Replies)
Discussion started by: xyyz
13 Replies

2. BSD

Snort on openbsd

Im trying to gather some info to set up snort on openbsd 3.2, has anyone out there managed to get it up and running ? My initial attempts seem to be quite below par (4 Replies)
Discussion started by: malcontent
4 Replies

3. Linux

snort port no

Hi, can anybody know snort port no in linux, (1 Reply)
Discussion started by: manoj.solaris
1 Replies

4. Cybersecurity

Snort/NTOP Placement

I have been asked to place 2 (1 NTOP & 1 SNORT) boxes within our network as part of our tool kit for network monitoring and Intrusion detection. Out network is very simplistic and it layed out like this: internet | | Cisco 1811 Router (8x Layer 2 switch ports) ... (0 Replies)
Discussion started by: metallica1973
0 Replies

5. Cybersecurity

Snort HTTPS

Is it possible to rule out in alert all HTTPS traffic or rule out all the HTTPS trafic from the alerts on snort ? (3 Replies)
Discussion started by: drd0spt
3 Replies

6. Homework & Coursework Questions

Error in installation of Snort 2.97.0

Use and complete the template provided. The entire template must be completed. If you don't, your post may be deleted! 1. The problem statement, all variables and given/known data: My system is Redhat 5.6. I want to install snort in my system which requires following dependencies. 1. Libpcap... (8 Replies)
Discussion started by: Ankur Goyal
8 Replies
PCAP_ACTIVATE(3)					     Library Functions Manual						  PCAP_ACTIVATE(3)

NAME
pcap_activate - activate a capture handle SYNOPSIS
#include <pcap/pcap.h> int pcap_activate(pcap_t *p); DESCRIPTION
pcap_activate() is used to activate a packet capture handle to look at packets on the network, with the options that were set on the handle being in effect. RETURN VALUE
pcap_activate() returns 0 on success without warnings, PCAP_WARNING_PROMISC_NOTSUP on success on a device that doesn't support promiscuous mode if promiscuous mode was requested, PCAP_WARNING_TSTAMP_TYPE_NOTSUP on success if the time stamp type specified in a previous pcap_set_tstamp_type() call isn't supported by the capture source (the time stamp type is left as the default), PCAP_WARNING on success with any other warning, PCAP_ERROR_ACTIVATED if the handle has already been activated, PCAP_ERROR_NO_SUCH_DEVICE if the capture source specified when the handle was created doesn't exist, PCAP_ERROR_PERM_DENIED if the process doesn't have permission to open the capture source, PCAP_ERROR_PROMISC_PERM_DENIED if the process has permission to open the capture source but doesn't have permission to put it into promiscuous mode, PCAP_ERROR_RFMON_NOTSUP if monitor mode was specified but the capture source doesn't support monitor mode, PCAP_ERROR_IFACE_NOT_UP if the capture source is not up, and PCAP_ERROR if another error occurred. If PCAP_WARNING or PCAP_ERROR is returned, pcap_geterr() or pcap_perror() may be called with p as an argument to fetch or display a message describing the warning or error. If PCAP_WARNING_PROMISC_NOTSUP, PCAP_ERROR_NO_SUCH_DEVICE, or PCAP_ERROR_PERM_DENIED is returned, pcap_geterr() or pcap_perror() may be called with p as an argument to fetch or display an message giving additional details about the problem that might be useful for debugging the problem if it's unexpected. SEE ALSO
pcap(3) 21 September 2010 PCAP_ACTIVATE(3)
All times are GMT -4. The time now is 10:45 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy