[Snort-devel] BUG in 2.0.2 build 94: Pidfile with wrong interface id

From: Martin Olsson <elof(at)sentor.se>
Date: Fri Oct 10 2003 - 07:44:59 EDT

Snort v2.0.2 build 94 (from cvs) creates a faulty pidfile in /var/run.

My FreeBSD 4.8-machine have two ethernet interfaces, bge0 and bge1. I use bge0 for remote communication and bge1 for snorting. bge1 have no IP address.

Even though I start snort on bge1, the pidfile is named
/var/run/snort_bge0.pid. It should be bge1, shouldn't it?

---

Speaking of the pidfile...
Just adding the interface id to the pid-filename isn't enough. I have four snort-processes running on the same interface! Since the filename isn't unique for each snort, the second started snort-process will overwrite the first one's pidfile, the third one will overwrite the second one's, and so on. At the end, the single pidfile found in /var/run will only contain the pid of the last snort started.

Either you should make the pid-filenames unique (adding a timestamp?) or let the user configure the filename. I would prefer and recommend the latter.

If no pid-filename have been manually configured you could automaticly generate a unique one. On the other hand, if it _is_ configured, then just use it as is (even if it overwrites an existing one). Don't add anything to this name (as you do with the tcpdump-file) - it only makes it harder to build a framework around the snort system if the filenames aren't always the same.

Do you agree with me?

/Martin

---

This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source Projects. See the people who have HELPED US provide better services: Click here: http://sourceforge.net/supporters.php

---

Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel Received on Fri Oct 10 07:50:05 2003