Snort mailing list archives
Re: new ruleset gives a fatal error
From: twig les <twigles () yahoo com>
Date: Mon, 19 Aug 2002 14:00:51 -0700 (PDT)
I'm replying to myself to add info :). I have been commenting out entire rules files to try to get snort working at all and every time I comment out one file, a different one nails me. It's always a bad port or a missing port. Since I haven't changed snort.conf (except now to comment out rules files) it looks like someone changed the rules syntax? Please let me know if I'm wrong (I want to be). --- twig les <twigles () yahoo com> wrote:
Hey all, I just dl'd the current ruleset today (Monday 8/19/02) and now Snort won't start. Running my config with -T gives me: [!] ERROR .//exploit.rules(22) => Bad port number: "(msg:"EXPLOIT" Fatal Error, Quitting.. I will paste the entire output at the end, but that's the ticket right there. I've been looking thru exploit.rules and tried commenting out a few rules that looked suspicious, but no luck. Does anyone know which rule this is? Note that I have Snort 1.8.6 and this config has been running fine for months with these exact startup options. This includes weekly rules updates. =================================================== snortbox# /usr/local/bin/snort -c /usr/local/snort/snort.conf -i ti0 -T Log directory = /var/log/snort Initializing Network Interface ti0 --== Initializing Snort ==-- Decoding Ethernet on interface ti0 Initializing Preprocessors! Initializing Plug-ins! Initializating Output Plugins! Parsing Rules file /usr/local/snort/snort.conf +++++++++++++++++++++++++++++++++++++++++++++++++++ Initializing rule chains... No arguments to frag2 directive, setting defaults to: Fragment timeout: 60 seconds Fragment memory cap: 4194304 bytes Stream4 config: Stateful inspection: ACTIVE Session statistics: INACTIVE Session timeout: 30 seconds Session memory cap: 8388608 bytes State alerts: INACTIVE Scan alerts: ACTIVE Log Flushed Streams: INACTIVE No arguments to stream4_reassemble, setting defaults: Reassemble client: ACTIVE Reassemble server: INACTIVE Reassemble ports: 21 23 25 53 80 143 110 111 513 Reassembly alerts: ACTIVE Reassembly method: FAVOR_OLD [!] ERROR .//exploit.rules(22) => Bad port number: "(msg:"EXPLOIT" Fatal Error, Quitting.. ================================================ =====
-----------------------------------------------------------
All warfare is based on deception.
-----------------------------------------------------------
__________________________________________________ Do You Yahoo!? HotJobs - Search Thousands of New Jobs http://www.hotjobs.com
-------------------------------------------------------
This sf.net email is sponsored by: OSDN - Tired of that same old cell phone? Get a new here for FREE!
https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users ===== ----------------------------------------------------------- All warfare is based on deception. ----------------------------------------------------------- __________________________________________________ Do You Yahoo!? HotJobs - Search Thousands of New Jobs http://www.hotjobs.com ------------------------------------------------------- This sf.net email is sponsored by: OSDN - Tired of that same old cell phone? Get a new here for FREE! https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- new ruleset gives a fatal error twig les (Aug 19)
- Re: new ruleset gives a fatal error twig les (Aug 19)
- Re: new ruleset gives a fatal error hackerwacker (Aug 19)
- Re: new ruleset gives a fatal error Matt Kettler (Aug 19)
- Re: new ruleset gives a fatal error twig les (Aug 19)
- Re: new ruleset gives a fatal error twig les (Aug 19)