problems

This is the snapshot of Snot Latest Rules

$Id: PROBLEMS,v 1.3 2002/08/16 15:32:26 chrisgreen Exp $

This is the Snort problems file.  It is used to document bugs that we
can't work around and provide a bit of documentation in case someone
finds a way to work around the problem.

Platform:  Linux/x86

adapter dropping out of promiscous mode

  if you see syslog messages complaining of obsolete (PF_INET,SOCK_PACKET),
  upgrade to libpcap 0.7+ and things should work correctly.

Platform:  Mac OS X 

- TCP traffic checksums are not handed up properly from pcap when the
  checksum is generated from the host that is doing the sniffing.
  Passive mode should work fine.

Platform: Linux/SPARC Linux/Alpha?

- Bus Errors ( Rumored to be compiler problem )

  Alignment problems.  Patches welcome.

Platform: HPUX

- Bus Errorrs with Stream4

  Compiler doesn't like bitpacked notation access

- HP-UX 10.x note from Chris Sylvain:

  if you run snort and receive the error message
    "ERROR: OpenPcap() device lan0 open:
                     recv_ack: promisc_phys: Invalid argument"
  it's because there's another program running using the DLPI service.

  The HP-UX implementation doesn't allow more than one libpcap program
  at a time to run, unlike Linux.