Re: Unknown ClassType: web-application-attack

["Matt M." <mr10001 () gmail com>]

Thanks Y.  I did what you said, then ran into whitelist/blacklist 507
errors.  So I commented out...

# If you are using reputation preprocessor set these
#var WHITE_LIST_PATH /etc/snort/rules
#var BLACK_LIST_PATH /etc/snort/rules

AND

# Reputation preprocessor. For more information see README.reputation
preprocessor reputation: \
   memcap 500, \
   priority whitelist, \
   nested_ip inner, \
#   whitelist $WHITE_LIST_PATH/white_list.rules, \
#   blacklist $BLACK_LIST_PATH/black_list.rules


Then I'm back in the same boat with the same error that I had before
related to the web-application-attack.

Thanks for any ideas on this one,


On Sat, Aug 30, 2014 at 2:27 AM, Y M <snort () outlook com> wrote:

> Date: Fri, 29 Aug 2014 17:29:43 -0500
> From: mr10001 () gmail com
> To: snort-users () lists sourceforge net
> Subject: [Snort-users] Unknown ClassType: web-application-attack
>
> Hey Guys,
>
> Been pounding the pig all day and still have a few kinks to work out.
>
> I've installed snort and pulledpork via brew on OSX.  With this groups
> help, I was able to get pulledpork functioning.  Now I'm getting the
> following error when trying to run snort with this command...
>  sudo snort -c /etc/snort/snort.conf -l /var/log/snort/
> *ERROR:*
> Initializing rule chains...
> ERROR: /etc/snort/rules/app-detect.rules(33) Unknown ClassType:
> web-application-attack
>
> Fatal Error, Quitting..
>
>
> Any ideas on what I'm missing?
>
> * Most probably, the web-application-attack is missing from the
> classification.config file.
>
> I did comment out the following (because I was getting a different error
> around black lists):
>
> # Reputation preprocessor. For more information see README.reputation
> preprocessor reputation: \
> #   memcap 500, \
> #   priority whitelist, \
> #   nested_ip inner, \
> #   whitelist $WHITE_LIST_PATH/white_list.rules, \
> #   blacklist $BLACK_LIST_PATH/black_list.rules
>
> Thanks for any thoughts,
>
> * Download up-to-date configuration files and replace the existing/older
> ones. You can download them from here:
> https://www.snort.org/configurations
>
> --
> M., CISSP, GCFE, GCFA
>
> *“*To disagree leads to study, to study leads to understanding, to
> understand is to appreciate, to appreciate is to love. So maybe I’ll end up
> loving your theory.*”* -*John Wheeler*
>
> ------------------------------------------------------------------------------
> Slashdot TV. Video for Nerds. Stuff that matters. http://tv.slashdot.org/
> _______________________________________________ Snort-users mailing list
> Snort-users () lists sourceforge net Go to this URL to change user options
> or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users
> <https://lists.sourceforge.net/lists/listinfo/snort-usersSnort-users>
> list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!



-- 
Matt M., CISSP, GCFE, GCFA

*“*To disagree leads to study, to study leads to understanding, to
understand is to appreciate, to appreciate is to love. So maybe I’ll end up
loving your theory.*”* -*John Wheeler*

------------------------------------------------------------------------------
Slashdot TV.  
Video for Nerds.  Stuff that matters.
http://tv.slashdot.org/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!