Snort error, can't get the path right for the dynamicpreprocessor

hi, i tought i give snort one more try but i cant overcome this error and cant find anything on google.
i followed this tutorial and feel like i am almost done but all the strings i use in the config file to create the right path for the dynamic preproccessor doesnt work. Does anyone knows a idea to try next?

root@OpenWrt:~# snort -c "/etc/snort/snort.conf" -i "lo" --daq-dir /usr/lib/daq
Running in IDS mode

        --== Initializing Snort ==--
Initializing Output Plugins!
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file "/etc/snort/snort.conf"
PortVar 'HTTP_PORTS' defined :  [ 80:81 311 383 591 593 901 1220 1414 1741 1830 2301 2381 2809 3037 3128 3702 4343 4848 5250 6988 7000:7001 7144:7145 7510 7777 7779 8000 8008 8014 8028 8080 8085 8088 8090 8118 8123 8180:8181 8243 8280 8300 8800 8888 8899 9000 9060 9080 9090:9091 9443 9999 11371 34443:34444 41080 50002 55555 ]
PortVar 'SHELLCODE_PORTS' defined :  [ 0:79 81:65535 ]
PortVar 'ORACLE_PORTS' defined :  [ 1024:65535 ]
PortVar 'SSH_PORTS' defined :  [ 22 ]
PortVar 'FTP_PORTS' defined :  [ 21 2100 3535 ]
PortVar 'SIP_PORTS' defined :  [ 5060:5061 5600 ]
PortVar 'FILE_DATA_PORTS' defined :  [ 80:81 110 143 311 383 591 593 901 1220 1414 1741 1830 2301 2381 2809 3037 3128 3702 4343 4848 5250 6988 7000:7001 7144:7145 7510 7777 7779 8000 8008 8014 8028 8080 8085 8088 8090 8118 8123 8180:8181 8243 8280 8300 8800 8888 8899 9000 9060 9080 9090:9091 9443 9999 11371 34443:34444 41080 50002 55555 ]
PortVar 'GTP_PORTS' defined :  [ 2123 2152 3386 ]
Detection:
   Search-Method = AC-Full-Q
    Split Any/Any group = enabled
    Search-Method-Optimizations = enabled
    Maximum pattern length = 20
Tagged Packet Limit: 256
Loading dynamic engine /usr/lib/snort_dynamicengine/libsf_engine.so... done
Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor...
  Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor/libsf_appid_preproc.so... ERROR: Failed to load /usr/lib/snort_dynamicpreprocessor/libsf_appid_preproc.so: Error relocating /usr/lib/snort_dynamicpreprocessor/libsf_appid_preproc.so: endrpcent: symbol not found
Fatal Error, Quitting..

i know for sure the packages are in /usr/lib/snort_dynamicpreprocessor/

and i saw some people with the same issue posting this code but i cant make any chocolate from it

root@OpenWrt:~# ldd /usr/lib/snort_dynamicpreprocessor/libsf_appid_preproc.so
        ldd (0x7f5fd3412000)
        libluajit-5.1.so.2 => /usr/lib/libluajit-5.1.so.2 (0x7f5fd2dfa000)
        libnghttp2.so.14 => /usr/lib/libnghttp2.so.14 (0x7f5fd2dd3000)
        libdnet.so.1 => /usr/lib/libdnet.so.1 (0x7f5fd2dc2000)
        libpcre.so.1 => /usr/lib/libpcre.so.1 (0x7f5fd2d66000)
        libpcap.so.1 => /usr/lib/libpcap.so.1 (0x7f5fd2d2c000)
        libuuid.so.1 => /usr/lib/libuuid.so.1 (0x7f5fd2d24000)
        libcrypto.so.1.1 => /usr/lib/libcrypto.so.1.1 (0x7f5fd2a60000)
        libdaq.so.4 => /usr/lib/libdaq.so.4 (0x7f5fd2a58000)
        libz.so.1 => /usr/lib/libz.so.1 (0x7f5fd2a44000)
        libgcc_s.so.1 => /lib/libgcc_s.so.1 (0x7f5fd2a30000)
        libc.so => ldd (0x7f5fd3412000)
Error relocating /usr/lib/snort_dynamicpreprocessor/libsf_appid_preproc.so: endrpcent: symbol not found
Error relocating /usr/lib/snort_dynamicpreprocessor/libsf_appid_preproc.so: getrpcent: symbol not found

I don't know of this helps but im using a APU 2 on 21.02.0
X86/64 system with snort 2.9.17-2

thanks in advance,

BTW
if this is a dumb question please respond with some seach terms that i can use to get closer to the solution, i love openwrt and learning about openwrt.

Hi, back again i tought ahhh if there are bug reports on snort 2 unsolved i just gonna try to get snort 3 running, And i think i have it running it uses like 2% cpu and 80mb ram.

Got 500 tcp rules from the community and a output from snort self but im not sure if it's doing its thing good right now, im still learning about openwrt and this i have done without tutorial :pleading_face:
.

So if you know more about snort and openwrt and howmuch ram snort 3 uses to work propper let me know :slight_smile: thanks in advance



Tue Oct 26 14:30:55 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:30:55 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:30:55 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:30:55 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:30:55 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:30:55 2021 auth.info snort: [116:444:1] "(ipv4) IPv4 option set" [Priority: 3] {IGMP} 10.60.175.46 -> 224.0.0.1
Tue Oct 26 14:31:09 2021 auth.info snort: "(arp_spoof) unicast ARP request"
Tue Oct 26 14:31:35 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:35 2021 auth.info snort: "(arp_spoof) unicast ARP request"
Tue Oct 26 14:31:35 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:35 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:51 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:31:56 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:32:02 2021 auth.info snort: "(arp_spoof) unicast ARP request"
Tue Oct 26 14:32:02 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:32:02 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:32:02 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:32:02 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:32:02 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:32:17 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:32:17 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:32:18 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:32:18 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:32:20 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:32:20 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:32:20 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:32:22 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:32:22 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:32:24 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:32:24 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:32:24 2021 auth.info snort: "(arp_spoof) unicast ARP request"
Tue Oct 26 14:32:50 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:32:50 2021 auth.info snort: "(arp_spoof) unicast ARP request"
Tue Oct 26 14:32:50 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:32:58 2021 auth.info snort: [122:3:1] "(port_scan) TCP portsweep" [Priority: 3] {TCP} hidden:43145 -> hidden:7716
Tue Oct 26 14:33:01 2021 auth.info snort: [116:444:1] "(ipv4) IPv4 option set" [Priority: 3] {IGMP} 10.60.175.46 -> 224.0.0.1
Tue Oct 26 14:33:19 2021 auth.info snort: "(arp_spoof) unicast ARP request"
Tue Oct 26 14:33:46 2021 auth.info snort: "(arp_spoof) unicast ARP request"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:01 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:09 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:09 2021 auth.info snort: [119:201:1] "(http_inspect) not HTTP traffic" [Priority: 3] {TCP} hidden:80 -> hidden:49322
Tue Oct 26 14:34:09 2021 auth.info snort: "(arp_spoof) unicast ARP request"
Tue Oct 26 14:34:22 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:34:35 2021 auth.info snort: "(arp_spoof) unicast ARP request"
Tue Oct 26 14:35:00 2021 auth.info snort: "(arp_spoof) unicast ARP request"
Tue Oct 26 14:35:05 2021 auth.info snort: [116:444:1] "(ipv4) IPv4 option set" [Priority: 3] {IGMP} 10.60.175.46 -> 224.0.0.1
Tue Oct 26 14:35:22 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:35:27 2021 auth.info snort: "(arp_spoof) unicast ARP request"
Tue Oct 26 14:35:36 2021 auth.info snort: [122:3:1] "(port_scan) TCP portsweep" [Priority: 3] {TCP} hidden:80 ->hidden:46762
Tue Oct 26 14:35:40 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:35:40 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:35:40 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:36:08 2021 auth.info snort: "(arp_spoof) unicast ARP request"
Tue Oct 26 14:36:29 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:36:31 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:36:31 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:36:31 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:36:31 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:36:31 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:36:31 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:36:31 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:36:31 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:36:31 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:36:32 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:36:32 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:36:32 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:36:32 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:36:32 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:36:51 2021 auth.info snort: "(arp_spoof) unicast ARP request"
Tue Oct 26 14:37:10 2021 auth.info snort: [116:444:1] "(ipv4) IPv4 option set" [Priority: 3] {IGMP} 10.60.175.46 -> 224.0.0.1
Tue Oct 26 14:37:13 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:37:13 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:37:13 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:37:14 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:37:14 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:37:19 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:37:19 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:37:34 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:37:34 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"
Tue Oct 26 14:37:34 2021 auth.info snort: "(arp_spoof) unicast ARP request"
Tue Oct 26 14:37:34 2021 auth.info snort: "(ipv4) IPv4 datagram length > captured length"

1 Like

depends on the amount of rules/load... 100 to 550M would be a realistic ballpark for small home network with a few to the majority of basic rules...

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.