0

Running snort (in packet dump mode) with command sudo snort -C snort.conf -A console -i eth0 a following problem occurred:

    --== Initializing Snort ==--
Initializing Output Plugins!
Snort BPF option: snort.conf
pcap DAQ configured to passive.
The DAQ version does not support reload.
Acquiring network traffic from "eth0".
ERROR: Can't set DAQ BPF filter to 'snort.conf' (pcap_daq_set_filter: pcap_compile: syntax error)!
Fatal Error, Quitting..

Can someone please suggest a solution?

ruuter
  • 2,453
  • 2
  • 30
  • 44
user2841047
  • 71
  • 2
  • 2
  • 8

3 Answers3

3

You're using the wrong option to load the configuration, it should be the lower case '-c'.

sudo snort -c snort.conf -A console -i eth0

Also, you can test your configuration with '-T' before running it:

sudo snort -T -c snort.conf
jonschipp
  • 781
  • 2
  • 9
  • 21
1

just put "-i" before eth0 in command it will solve the problem

Swapnilkumar Rane
  • 11
  • 2
0

Try this:

sudo service snort
ps ax|grep snortstart

The output I got was

/usr/sbin/snort -m 027 -D -d -l /var/log/snort -u snort -g snort -c /etc/snort/snort.conf -S HOME_NET=[192.168.0.0/16] -i enp4s0

The man page says -D Run Snort in daemon mode. Alerts are sent to /var/log/snort/alert unless otherwise specified.

So when I drop the -D and add the -A

sudo /usr/sbin/snort -m 027 -d -l /var/log/snort -u snort -g snort -c /etc/snort/snort.conf -S HOME_NET=[192.168.0.0/16] -i enp4s0 -A console

Works for snort Version 2.9.7.0 GRE (Build 149)

kkron
  • 564
  • 3
  • 20