[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: snort problem

On Tue, Feb 20, 2001 at 11:21:45AM +0200, Viljo Marrandi wrote:
> Hello,
> I'm not sure if this is the right list but i try. Problem is with snort,
> when i try to start it, then i get to daemon.log following lines:
> Feb 20 10:54:17 equinoxe modprobe: modprobe: Can't locate module net-pf-17
> Feb 20 10:54:17 equinoxe snort: ERROR: OpenPcap() device eth0 open:
> ^Isocket: Socket type not supported
> Firstly, what is net-pf-17? I couldn't find it anywhere (grepped thru
> kernel source). And why it says that socket type not supported? I
> installed all required packages for it - libc6_2.2.1 and libpcap0. What
> couls possibly be wrong?

 Build your kernel with the CONFIG_PACKET option.  if you build it as a
module, it will be called af_packet.o, and modprobe knows the 
net-pf-17 -> af_packet  alias, so you don't have to do anything.  If you
build it into the kernel proper, you still don't have to do anything :)

#define X(x,y) x##y
Peter Cordes ;  e-mail: X(peter@llama.nslug. , ns.ca)

"The gods confound the man who first found out how to distinguish the hours!
 Confound him, too, who in this place set up a sundial, to cut and hack
 my day so wretchedly into small pieces!" -- Plautus, 200 BCE

Reply to: