[Snort-users] FreeBSD 5.3 OpenPcap() FSM compilation failed:

permalink · #1 (**permalink**) 12-29-2004

This is a multi-part message in MIME format.

------_=_NextPart_001_01C4EDE1.A357CF6A
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

I am running FreeBSD 5.3 and port installation of snort 2.1.3
It seems to run OK with default startup script in
/usr/local/etc/rc.d/snort.sh
But when I try run with option -F bpf support it failed.
=20
It runs OK with the following:
/usr/local/bin/snort -c /usr/local/etc/snort.conf -i em1
=20
But when I try to add -F bpf support, it failed
/usr/local/bin/snort -c /usr/local/etc/snort.conf -i em1 -F
/usr/local/share/snort/filters.bpf
=20
below is the error I got
=20
wa05sp# /usr/local/bin/snort -c /usr/local/etc/snort.conf -i em1 -F
/usr/local/share/snort/filters.bpf
Running in IDS mode
Log directory =3D /var/log/snort
=20
Initializing Network Interface em1
OpenPcap() device em1 network lookup:
em1: no IPv4 address assigned
ERROR: OpenPcap() FSM compilation failed:
syntax error
PCAP command: not dst host 224.0.0.13
not dst host 224.0.16.171
not dst host 237.168.2.151
=20
Fatal Error, Quitting..
=20
wa05sp# less /usr/local/share/snort/filters.bpf
not dst host 224.0.0.13
not dst host 224.0.16.171
not dst host 237.168.2.151
/usr/local/share/snort/filters.bpf (END)
=20
This is a Dell PowerEdge 2850 with 2 Gig built in network ports
=20
Thanks for your help

------_=_NextPart_001_01C4EDE1.A357CF6A
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns=3D"http://www.w3.org/TR/REC-html40">

<head>
<meta http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<meta name=3DProgId content=3DWord.Document>
<meta name=3DGenerator content=3D"Microsoft Word 11">
<meta name=3DOriginator content=3D"Microsoft Word 11">
<link rel=3DFile-List href=3D"cid:filelist.xml@01C4ED9E.94F275B0">

<style>

</style>

</head>

<body lang=3DEN-US link=3Dblue vlink=3Dpurple =
style=3D'tab-interval:.5in'>

<div class=3DSection1>

I am running FreeBSD 5.3 and port installation of =
snort 2.1.3<o:p></o:p>

It seems to run OK with default startup script in =
/usr/local/etc/rc.d/snort.sh<o:p></o:p></font=
>

But when I try run with option –F bpf
support it failed.<o:p></o:p>

<o:p> </o:p>

It runs OK with the =
following:<o:p></o:p>

/usr/local/bin/snort -c =
/usr/local/etc/snort.conf –i
em1<o:p></o:p>

<o:p> </o:p>

But when I try to add –F bpf
support, it failed<o:p></o:p>

/usr/local/bin/snort -c =
/usr/local/etc/snort.conf -i em1
-F /usr/local/share/snort/filters.bpf<o:p></o:p>=


<o:p> </o:p>

below<f=
ont
size=3D2 face=3DArial> is the
error I got<o:p></o:p>

<o:p> </o:p>

wa05sp# /usr/local/bin/snort -c /usr/local/etc/snort.conf -i em1
-F /usr/local/share/snort/filters.bpf<o:p></o:p>=


Running in IDS mode<o:p></o:p>

Log directory =3D /var/log/snort<o:p></o:p>

<o:p> </o:p>

Initializing Network Interface =
em1<o:p></o:p>

OpenPcap</span=
>() device em1 network =
lookup:<o:p></o:p>

         =
em1:
no IPv4 address assigned<o:p></o:p>

ERROR: OpenPcap() FSM compilation =
failed:<o:p></o:p>

         =
syntax error<o:p></o:p>

PCAP command: not dst
host 224.0.0.13<o:p></o:p>

not<fon=
t
size=3D2 face=3DArial> dst host 224.0.16.171<o:p></o:p>

not<fon=
t
size=3D2 face=3DArial> dst host =
237.168.2.151<o:p></o:p>

<o:p> </o:p>

Fatal Error, Quitting..<o:p></o:p>

<o:p> </o:p>

wa05sp# less /usr/local/share/snort/filters.bpf<o:p></o:p>=


not<fon=
t
size=3D2 face=3DArial> dst host 224.0.0.13<o:p></o:p>

not<fon=
t
size=3D2 face=3DArial> dst host 224.0.16.171<o:p></o:p>

not<fon=
t
size=3D2 face=3DArial> dst host =
237.168.2.151<o:p></o:p>

/usr/local/share/snort/filters.bpf
(END)<o:p></o:p>

<o:p> </o:p>

This is a Dell PowerEdge =
2850 with
2 Gig built in network ports<o:p></o:p>

<o:p> </o:p>

Thanks for your help<o:p></o:p>

</div>

</body>

</html>

------_=_NextPart_001_01C4EDE1.A357CF6A--

-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode