Snort 184.108.40.206 pkg v. 2.5.2 dies on IP change
Upgraded to the new snort on 2.0.1 amd64, but snort is dying on every IP-change from my ISP. With the 2.5.1 a deinstall and new install resolved the problem for a while, but it came back.
What i noticed by this way is the fact that snort didnt die till the first automatic update of rules. After the first update of rules its dying regulary.
well, my snort does not die from downloading new rulesets… maybe your snort interface encounters an error trying to download new rules when there is no internet connection due to a change of ip. Also, new rules could require the presence of preprocessors which have been inactive when running with older rules.
hope this helps.
thank for that advice, but the logs didnt show a (maybe failed) update, when the IP changes, it only and quietly dies. Without any further notice. :(
Last log-entries were always the IP-change, then as next entry something like "snort quitting" - nothing more.
But what i see the last days is that sometimes it doesnt die on IP-change. hmmm. Hard to resolve, i think.