>This is the one piece of the puzzle I hadn't tested on AMD64. > >I'm getting the infamous "ERROR: Invalid packet length" on this >laptop. I've checked the usual things like hard drive space, and I >even compiled snort 2.4 by hand to see if that affected things. No >change. > >It's working fine on macppc and i386 though. > >ddp
Right, this is bug of unified logging/alerting since unified output plugin was introduced. Detailed info you can find here: http://secure.lv/~nikns/stuff/snort_64bit.txt I have contacted sourcefire and they are looking forward to commit fix till 2.6.1 release. Fixed/updated barnyard tarball: http://secure.lv/~nikns/stuff/ports/barnyard-0.2.0.tar Fix for snort was sent to ports@ few days back.