Snort mailing list archives
Re: [Snortsam-discussion] HELP: setting upSnortSamrunsSnort-2.8.0+BASE+Barnyard
From: Rachmat Hidayat Al-Anshar <rachmat_hidayat_02 () yahoo com>
Date: Fri, 9 Nov 2007 19:43:18 -0800 (PST)
How is it Matt? How about SnortSam plugin for Snort-2.8.0, is it already patched correctly? Now i'm use SnortSam prepatched (precompiled?!) snort-snortsam-2.7.0.tar.gz from snortsam.net package. Is it any problem with this? Any configuration that i've to add when compiling snort (to add the SnortSam functionality)? ----- Original Message ---- From: Matt Jonkman <jonkman () jonkmans com> To: snortsam-discussion () snortsam net Cc: Joel Esler <joel.esler () sourcefire com>; Snort-users () lists sourceforge net Sent: Thursday, November 8, 2007 11:32:07 AM Subject: Re: [Snortsam-discussion] [Snort-users] HELP: setting upSnortSamrunsSnort-2.8.0+BASE+Barnyard It does not yet. It's not been modified for 2.8 correctly yet. I'll announce as soon as it is... Matt Anthony Rodgers wrote:
The patch is supposed to supply a patched call to RegisterPlugin() -
if
it doesn't, I'd like to know...... CP -----Original Message----- From: snortsam-discussion-bounces () snortsam net [mailto:snortsam-discussion-bounces () snortsam net] On Behalf Of Will Metcalf Sent: Saturday, November 03, 2007 6:46 AM To: Joel Esler Cc: Snort-users () lists sourceforge net;
snortsam-discussion () snortsam net
Subject: Re: [Snortsam-discussion] [Snort-users] HELP: setting upSnortSamrunsSnort-2.8.0+BASE+Barnyard It appears as if the patch is broken. It looks like RegisterPlugin requires an OptType in 2.8 and whoever updated the patch did not
specify
one. so In spo_alert_fwsam.c RegisterPlugin("fwsam", AlertFWsamOptionInit); Needs to be something like.... RegisterPlugin("fwsam", AlertFWsamOptionInit,OPT_TYPE_ACTION); here are the opt types you can specify. I'm not sure which does
what,
maybe Joel can clarify the correct one to use. Need to go pack now, getting ready for an 11 hour flight ;-)... OPT_TYPE_ACTION = 0, OPT_TYPE_LOGGING, OPT_TYPE_DETECTION, OPT_TYPE_MAX Regards, Will On 11/3/07, Joel Esler <joel.esler () sourcefire com> wrote:What version of Snort are you running? Is SnortSAM compatible with that version? Did you notice you typed "--with-ysql-libraries" instead of "--with-mysql-libraries". In addition to that, I recommend you do NOT have Snort log directly
to
the DB, instead, use Snort to log to unified, then have a separate tool named "barnyard" to insert the unified files into the DB. J On Nov 3, 2007, at 1:49 AM, Rachmat Hidayat Al-Anshar wrote: All right then, I've been trying to going through this process with ignoring the warning message produced by aclocal. The proccess continued # autoheader # automake -add-missing # autoconf #./configure --enable-dynamicplugin --with-mysql-includes=/usr/include/mysql --with-ysql-libraries=/usr/lib and suddenly... spo_alert_fwsam.c: In function 'AlertFWsamSetup': spo_alert_fwsam.c:143: warning: passing arg 3 of 'RegisterOutputPlugin' from incompatible pointer type spo_alert_fwsam.c:144: error: too few arguments to function'RegisterPlugin'spo_alert_fwsam.c: In function 'AlertFWsam': spo_alert_fwsam.c:905: warning: passing arg 2 of 'TwoFishEncrypt'
from
incompatible pointer type spo_alert_fwsam.c:940: warning: passing arg 2 of 'TwoFishDecrypt'
from
incompatible pointer type spo_alert_fwsam.c:946: warning: passing arg 2 of 'TwoFishDecrypt'
from
incompatible pointer type spo_alert_fwsam.c:979: warning: passing arg 2 of 'TwoFishDecrypt'
from
incompatible pointer type spo_alert_fwsam.c:985: warning: passing arg 2 of 'TwoFishDecrypt'
from
incompatible pointer type spo_alert_fwsam.c: In function 'FWsamCheckOut': spo_alert_fwsam.c:1141: warning: passing arg 2 of 'TwoFishEncrypt' from incompatible pointer type spo_alert_fwsam.c:1157: warning: passing arg 2 of 'TwoFishDecrypt' from incompatible pointer type spo_alert_fwsam.c:1163: warning: passing arg 2 of 'TwoFishDecrypt' from incompatible pointer type spo_alert_fwsam.c: In function 'FWsamCheckIn': spo_alert_fwsam.c:1274: warning: passing arg 2 of 'TwoFishEncrypt' from incompatible pointer type spo_alert_fwsam.c:1293: warning: passing arg 2 of 'TwoFishDecrypt' from incompatible pointer type make[3]: *** [spo_alert_fwsam.o] Error 1 make[3]: Leaving directory'/research/snort/snort-2.8.0/src/output-plugins'make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory '/research/snort/snort-2.8.0/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory '/research/snort/snort-2.8.0' make: *** [all] Error 2 What's wrong with snort?! How to solve this? Any response will be appreciated Thanks (^^!) Mat __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com
----------------------------------------------------------------------
--- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and abrowser.Download your FREE copy of Splunk now >>
http://get.splunk.com/_______________________________________________
Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
----------------------------------------------------------------------
--- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and abrowser.Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users_______________________________________________ Snortsam-discussion mailing list Snortsam-discussion () snortsam net http://lists.snortsam.net/mailman/listinfo/snortsam-discussion _______________________________________________ Snortsam-discussion mailing list Snortsam-discussion () snortsam net http://lists.snortsam.net/mailman/listinfo/snortsam-discussion
-- -------------------------------------------- Matthew Jonkman Bleeding Edge Threats US Phone 765-429-0398 US Fax 312-264-0205 AUS Phone 61-42-4157-491 AUS Fax 61-29-4750-026 http://www.bleedingthreats.net -------------------------------------------- PGP: http://www.bleedingthreats.com/mattjonkman.asc _______________________________________________ Snortsam-discussion mailing list Snortsam-discussion () snortsam net http://lists.snortsam.net/mailman/listinfo/snortsam-discussion __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com
------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Fw: [Snortsam-discussion] HELP: setting upSnortSamrunsSnort-2.8.0+BASE+Barnyard Rachmat Hidayat Al-Anshar (Nov 07)
- <Possible follow-ups>
- Re: [Snortsam-discussion] HELP: setting upSnortSamrunsSnort-2.8.0+BASE+Barnyard Rachmat Hidayat Al-Anshar (Nov 09)