Re: snort error config option "detection" ...

[Adam Szabo <adamx001 () gmail com>]

Detection: Search-Method = AC-BNFA-Q
ERROR: /etc/snort/snort.conf(273) Config option "detection" can only be
configured once.

Adam Szabo

On Sat, Oct 24, 2009 at 6:23 PM, Nigel Houghton <nhoughton () sourcefire com>wrote:

> On Sat, Oct 24, 2009 at 3:47 AM, Adam Szabo <adamx001 () gmail com> wrote:
> > Still not working. The configuration is the default i downloaded from
> > snort.com. I only changed the HOME_NET and EXTERNAL_NET variables and
> the
> > rules path.
> >
> > Adam Szabo
> >
> > On Thu, Oct 22, 2009 at 10:43 PM, Russ Combs <rcombs () sourcefire com>
> wrote:
> > > You've got a typo on every line!  (see below)
> > >
> > > With those fixes I can run either lines 1 and 3 or lines 2 and 3 through
> > > snort -T.
> > >
> > > If that doesn't fix it, send your conf.
> > >
> > > Russ
> > > On Thu, Oct 22, 2009 at 2:15 PM, Adam Szabo <adamx001 () gmail com> wrote:
> > > > I have these:
> > > > config detection: search-method lowmen
> > >
> > > lowmen -> lowmem
> > >
> > > > config detection: search method ac-bnfa max_queue_events 5
> > >
> > > search method -> search-method
> > >
> > > > config event_queue: max_queue 8 log 3 order_events content_lenght
> > >
> > > content_lenght -> content-length
> > > > Adam Szabo
> > > >
> > > > On Thu, Oct 22, 2009 at 8:09 PM, Matt Olney <molney () sourcefire com>
> > > > wrote:
> > > > > Is it possible that you have multiple detection statements?
> > > > >
> > > > > grep detection snort.conf
> > > > >
> > > > > On Thu, Oct 22, 2009 at 1:58 PM, Adam Szabo <adamx001 () gmail com>
> wrote:
> > > > > > Hi,
> > > > > > I'm running Snort 2.8.5 on Ubuntu linux and i'm getting this error
> > > > > > when i
> > > > > > start Snort (snort -c /etc/snort/snort.conf):
> > > > > >
> > > > > > "Detection: Search-Method = AC-BNFA-Q
> > > > > > ERROR: /etc/snort/snort.conf(273) Config option "detection" can only
> > > > > > be
> > > > > > configured once."
> > > > > >
> > > > > > I did not change anything near line 273, so i don't know why is this
> > > > > > happening. Can you help me?
> > > > > >
> > > > > > Thank you,
> > > > > > Adam Szabo
> ------------------------------------------------------------------------------
> > > > > > Come build with us! The BlackBerry(R) Developer Conference in SF, CA
> > > > > > is the only developer event you need to attend this year. Jumpstart
> > > > > > your
> > > > > > developing skills, take BlackBerry mobile applications to market and
> > > > > > stay
> > > > > > ahead of the curve. Join us from November 9 - 12, 2009. Register
> now!
> > > > > > http://p.sf.net/sfu/devconference
> > > > > > _______________________________________________
> > > > > > Snort-users mailing list
> > > > > > Snort-users () lists sourceforge net
> > > > > > Go to this URL to change user options or unsubscribe:
> > > > > > https://lists.sourceforge.net/lists/listinfo/snort-users
> > > > > > Snort-users list archive:
> > > > > > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> ------------------------------------------------------------------------------
> > > > Come build with us! The BlackBerry(R) Developer Conference in SF, CA
> > > > is the only developer event you need to attend this year. Jumpstart
> your
> > > > developing skills, take BlackBerry mobile applications to market and
> stay
> > > > ahead of the curve. Join us from November 9 - 12, 2009. Register now!
> > > > http://p.sf.net/sfu/devconference
> > > > _______________________________________________
> > > > Snort-users mailing list
> > > > Snort-users () lists sourceforge net
> > > > Go to this URL to change user options or unsubscribe:
> > > > https://lists.sourceforge.net/lists/listinfo/snort-users
> > > > Snort-users list archive:
> > > > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> ------------------------------------------------------------------------------
> > Come build with us! The BlackBerry(R) Developer Conference in SF, CA
> > is the only developer event you need to attend this year. Jumpstart your
> > developing skills, take BlackBerry mobile applications to market and stay
> > ahead of the curve. Join us from November 9 - 12, 2009. Register now!
> > http://p.sf.net/sfu/devconference
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
> What exactly is the error you are getting now?
>
> --
> Nigel Houghton
> Head Mentalist
> SF VRT
> http://vrt-sourcefire.blogspot.com && http://www.snort.org/vrt/
------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay 
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users