Re: Unknown argument to http_decode preprocessor:

["Augustinho Catto" <Catto () atlas unisinos br>]

Hi,
Excuse me, I am a newbie but I think something is wrong becouse I 
downloaded a "stable" version of signatures. I used oinkmaster.pl 
and It was started from my cron to perform download from:
url = http://www.snort.org/dl/signatures/snortrules.tar.gz

What is the best practices when upgrading signatures?

TIA

Catto


"Cameron Just" <c.just () phoenixdigital com> writes:

> Hi,
>
> I have followed the REdhat 7.2 instructions to the letter and 
keepgetting
> this error. Anyone know whats causing it?
>
> Aug  2 22:54:42 router snort: FATAL ERROR: ERROR
> /etc/snort/snort.conf(229) => Unknown argument to http_decode
> preprocessor: "unicode"
>
> The offending line is this which is in the standard snort.conf
>
> preprocessor http_decode: 80 unicode iis_alt_unicode 
double_encode
> iis_flip_slash full_whitespace


looks like 1.9 conf with 1.8 snort
-- 
Chris Green <cmg () sourcefire com>
A good pun is its own reword.


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
[prev in list] [next in list] [prev in thread] [next in thread] 


Augustinho Valmor CATTO
CNE - Analista de Suporte 
UNISINOS - Universidade do Vale do Rio dos Sinos
Sao Leopoldo - RS - Brasil
Phone: +55 xx 51 590-8386
http://www.unisinos.br/institucional/estrutura/
"From Brazil the land of FIFA worldwide soccer five times 
championship"





-------------------------------------------------------
This sf.net email is sponsored by: Dice - The leading online job board
for high-tech professionals. Search and apply for tech jobs today!
http://seeker.dice.com/seeker.epl?rel_code=31
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users