Snort mailing list archives
Re: ERROR: Please activate spp_conversation before trying to activate spp_portscan2
From: Neil Dickey <neil () geol niu edu>
Date: Mon, 21 Apr 2003 11:55:20 -0500 (CDT)
Kit Massengill <KitM () FirstEquipment com> wrote asking:
Here's what happens when I try to start Snort now: ...snip... ERROR: Please activate spp_conversation before trying to activate spp_portscan2 Fatal Error, Quitting.. [FAILED]
I think this means that you have to have a line like this ... preprocessor conversation: allowed_ip_protocols all, \ timeout 60, max_conversations 3000 ... just above this line ... preprocessor portscan2: scanners_max 256, targets_max 1024, \ target_limit 5, port_limit 20, timeout 60, log \ /var/snort/snort_portscan.log ... in your snort.conf file. Perhaps you deleted it or commented it out? The backslashes mean that the arguments should be read as part of one single line of text. I hope this helps. Best regards, Neil Dickey, Ph.D. Research Associate/Sysop Geology Department Northern Illinois University DeKalb, Illinois 60115 ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- ERROR: Please activate spp_conversation before trying to activate spp_portscan2 Kit Massengill (Apr 21)
- <Possible follow-ups>
- Re: ERROR: Please activate spp_conversation before trying to activate spp_portscan2 Neil Dickey (Apr 21)