snort[5785]: FATAL ERROR: OpenPcap() device eth0 open: bind: Network is down

shams · 05-07-2007, 12:55 AM

hi,
i have single pc and use dialup modem to connect to the internet, my pc has the0 but it is stopped and not starting at boot time in fedora core 6, when want to start the snort get this error:
snort[5785]: FATAL ERROR: OpenPcap() device eth0 open: bind: Network is down
i am using Community-Rules-CURRENT.tar.gz for the snort rules.

unSpawn · 05-07-2007, 03:53 PM

Like it says. If the network interface is down libpcap can't do anything with it. Fix your network interface problems and this one will be gone.

shams · 05-08-2007, 09:11 PM

hi unSpawn,
thanks for reply, may be i couldn't explain my problem clearly duo to my poor english, i will try again.
snort is asking for the th0 to be up, but as i mentioned above my eth0 is disabled and not loading at boot time, because my pc is not connected to any other computer , i have single pc, using my dialup modem to connect to my isp, now pleas help me how i can tell snort to ignore the eth0?

unSpawn · 05-09-2007, 04:39 PM

how i can tell snort to ignore the eth0?
By explicitly configuring it to listen to ppp0? You may want to use some form of "post up" script that only activates Snort to start when or after PPP is activated.