Re: snort problem
On Tue, Feb 20, 2001 at 11:21:45AM +0200, Viljo Marrandi wrote:
> Hello,
>
> I'm not sure if this is the right list but i try. Problem is with snort,
> when i try to start it, then i get to daemon.log following lines:
>
>
> Feb 20 10:54:17 equinoxe modprobe: modprobe: Can't locate module net-pf-17
> Feb 20 10:54:17 equinoxe snort: ERROR: OpenPcap() device eth0 open:
> ^Isocket: Socket type not supported
>
> Firstly, what is net-pf-17? I couldn't find it anywhere (grepped thru
> kernel source). And why it says that socket type not supported? I
> installed all required packages for it - libc6_2.2.1 and libpcap0. What
> couls possibly be wrong?
Build your kernel with the CONFIG_PACKET option. if you build it as a
module, it will be called af_packet.o, and modprobe knows the
net-pf-17 -> af_packet alias, so you don't have to do anything. If you
build it into the kernel proper, you still don't have to do anything :)
--
#define X(x,y) x##y
Peter Cordes ; e-mail: X(peter@llama.nslug. , ns.ca)
"The gods confound the man who first found out how to distinguish the hours!
Confound him, too, who in this place set up a sundial, to cut and hack
my day so wretchedly into small pieces!" -- Plautus, 200 BCE
Reply to: