Re: bad priority messages

[John Sage <jsage () finchhaven com>]

I haven't been doing well in answering questions, today, but how's
this set:

<snip>
#
# Include classification & priority settings
# 

include classification.config
#
<snip>

in your snort.conf?

If memory servers, this has to be on, if not, I believe you get just
the sort of errors you're seeing..

..I'll go back to sleep, now.


- John
-- 
The weirdest thing about Window$ is that it's so opaque



On Mon, Mar 25, 2002 at 01:12:38AM +0100, Mipam wrote:
> Hi,
>
> When im starting snort-1.8.4 im getting these mesages:
>
> Mar 25 01:02:31  snort: ERROR snort_icmp.conf(103) => Bad Priority
> setting "attempted-recon"
> Mar 25 01:02:31  snort: ERROR snort_icmp.conf(108) => Bad Priority
> setting "bad-unknown"
> Mar 25 01:02:31  snort: ERROR snort_icmp.conf(115) => Bad Priority
> setting "misc-activity"
>
> I just the icmp.rules default file with entries like these:
>
> alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP ISS Pinger"; content:"|
> 495353504e475251|";itype:8;depth:32; reference:arachnids,158; classtype:attempte
> d-recon; sid:465; rev:1;)
>
> Any hints?
> Bye,
>
> Mipam.

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users