Snort 2.9.2.3 pkg v. 2.5.2 dies on IP change

[_igor_]

Upgraded to the new snort on 2.0.1 amd64, but snort is dying on every IP-change from my ISP. With the 2.5.1 a deinstall and new install resolved the problem for a while, but it came back.

What i noticed by this way is the fact that snort didnt die till the first automatic update of rules. After the first update of rules its dying regulary.

[moe2006]

well, my snort does not die from downloading new rulesets… maybe your snort interface encounters an error trying to download new rules when there is no internet connection due to a change of ip. Also, new rules could require the presence of preprocessors which have been inactive when running with older rules.

hope this helps.

[_igor_]

thank for that advice, but the logs didnt show a (maybe failed) update, when the IP changes, it only and quietly dies. Without any further notice. :(
Last log-entries were always the IP-change, then as next entry something like  "snort quitting" - nothing more.

But what i see the last days is that sometimes it doesnt die on IP-change. hmmm. Hard to resolve, i think.