File: PROBLEMS

package info (click to toggle)
snort 2.3.2-3
  • links: PTS
  • area: main
  • in suites: sarge
  • size: 22,244 kB
  • ctags: 11,282
  • sloc: ansic: 70,376; sh: 4,364; makefile: 744; perl: 478; sql: 212
file content (40 lines) | stat: -rw-r--r-- 1,220 bytes parent folder | download | duplicates (2)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
$Id: PROBLEMS,v 1.3 2002/08/16 15:32:26 chrisgreen Exp $

This is the Snort problems file.  It is used to document bugs that we
can't work around and provide a bit of documentation in case someone
finds a way to work around the problem.

Platform:  Linux/x86

adapter dropping out of promiscous mode

  if you see syslog messages complaining of obsolete (PF_INET,SOCK_PACKET),
  upgrade to libpcap 0.7+ and things should work correctly.

Platform:  Mac OS X 

- TCP traffic checksums are not handed up properly from pcap when the
  checksum is generated from the host that is doing the sniffing.
  Passive mode should work fine.

Platform: Linux/SPARC Linux/Alpha?

- Bus Errors ( Rumored to be compiler problem )

  Alignment problems.  Patches welcome.

Platform: HPUX

- Bus Errorrs with Stream4

  Compiler doesn't like bitpacked notation access

- HP-UX 10.x note from Chris Sylvain:

  if you run snort and receive the error message
    "ERROR: OpenPcap() device lan0 open:
                     recv_ack: promisc_phys: Invalid argument"
  it's because there's another program running using the DLPI service.

  The HP-UX implementation doesn't allow more than one libpcap program
  at a time to run, unlike Linux.