Snort won't start after update

Jukas · 02-22-2008, 02:05 PM

I just finished updating a debian box from Etch to Lenny and now snort won't run as a daemon. When I try and start it via /etc/init.d/snort I get the following error.

Code:

nix:/home/# /etc/init.d/snort start
Starting Network Intrusion Detection System : snort (eth0 ...ERROR: interface not available) failed!

Code:

nix:/etc# dpkg-reconfigure snort
/usr/sbin/dpkg-reconfigure: snort is broken or not fully installed

I've done a full apt-get purge snort and verified that no components were installed still before re-installing it, with the same result.

Here is my snort.debian.conf

Code:

DEBIAN_SNORT_STARTUP="boot"
DEBIAN_SNORT_HOME_NET="192.168.1.0./24"
DEBIAN_SNORT_OPTIONS=""
DEBIAN_SNORT_INTERFACE="eth0"
DEBIAN_SNORT_SEND_STATS="true"
DEBIAN_SNORT_STATS_RCPT="root"
DEBIAN_SNORT_STATS_THRESHOLD="1"

Any ideas?

unSpawn · 02-22-2008, 07:15 PM

Start Snort from the CLI, supply the test switch ("-T") and capture stdout and stderr to a logfile. Check logfile for clues, else post contents, preferably in BB code tags for readability.

Jukas · 02-25-2008, 11:52 PM

Thanks for the pointers, I tracked the issue down to the 1394 adapter and the last kernel update I did.