Re: Snort http_decode preprocessor

[Joerg Weber <j.weber () infos de>]

Hi Ralph,

you might want to try
preprocessor http_decode: 80 unicode
without the -. I don't know what happend to the cginull parameter.

You'r correct, though, that the Snort Users Manual (1.9.1) specifies
both -unicode and -cginull
which won't work on my Snort Version 1.9.1 (Build 231) either.

Cheers,

Joerg

On Tue, 2003-03-04 at 13:43, Ralph Zimmermann wrote:
> Hi,
>
> I've just upgraded from snort version 1.8.7 (Build 128) to snort version 
> 1.9.1 (Build 231).
> When I try to restart my snort processes I get an error in 
> /var/log/messages and snort
> is stopping. The error is:
>
> Mar  4 09:57:05 xxxx snort: FATAL ERROR: ERROR: 
> /usr/local/bin/snort/s1dmz.conf(185) => Unknown argument to http_decode 
> preprocessor: "-unicode"
>
> > From what I saw in the 1.9.1 docs, the arguments to the http_decode 
> preprocessor didn't change.
> Snort is configured as follows: preprocessor http_decode: 80 -unicode 
> -cginull
> which is correct, from what I know.
>
> Any clues ???
>
> Many thanks for your help.
> Regards
>
> Ralph Zimmermann
> _____________________________________
> - Network Administrator -
>
> SALT AG
> Sedanstraße 23
> D-97082 Würzburg
>
> Tel:  +49 931 3573 - 400
> Fax: +49 931 3573 - 409
>
> mailto: ralph.zimmermann () salt-ag com
> Besuchen Sie uns unter www.salt-ag.com
>
>       CeBIT 2003
>       12. - 19. März in Hannover
>       Sie finden SALT in Halle 7 Stand D 21
>
>
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Etnus, makers of TotalView, The debugger 
> for complex code. Debugging C/C++ programs can leave you feeling lost and 
> disoriented. TotalView can help you find your way. Available on major UNIX 
> and Linux platforms. Try it free. www.etnus.com
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
-- 
Joerg Weber
Network Security

infoServe GmbH
Nell-Breuning-Allee 6
D-66115 Saarbruecken

T: (0681) 8 80 08 - 0
F: (0681) 8 80 08 - 59
www.infos.de
E: j.weber () infos de

Attachment: signature.asc
Description: This is a digitally signed message part