Snort mailing list archives
Re: Snort 2.0 rc1 available
From: "Master Brian" <mangabbs () hotmail com>
Date: Thu, 27 Mar 2003 11:37:40 +0100
Greetings, I'm having problem with this distribution of snort with oracle support like with 1.9.1... this is what snort says: [root@agcmint bin]# ./snort -c /etc/snort/snort3.conf Initializing Output Plugins! Running in IDS mode Log directory = /var/log/snort Initializing Network Interface eth0 --== Initializing Snort ==-- Decoding Ethernet on interface eth0 Initializing Preprocessors! Initializing Plug-ins! Parsing Rules file /etc/snort/snort3.conf +++++++++++++++++++++++++++++++++++++++++++++++++++ Initializing rule chains... No arguments to frag2 directive, setting defaults to: Fragment timeout: 60 seconds Fragment memory cap: 4194304 bytes Fragment min_ttl: 0 Fragment ttl_limit: 5 Fragment Problems: 0 Self preservation threshold: 500 Self preservation period: 90 Suspend threshold: 1000 Suspend period: 30 Stream4 config: Stateful inspection: ACTIVE Session statistics: INACTIVE Session timeout: 30 seconds Session memory cap: 8388608 bytes State alerts: INACTIVE Evasion alerts: INACTIVE Scan alerts: ACTIVE Log Flushed Streams: INACTIVE MinTTL: 1 TTL Limit: 5 Async Link: 0 State Protection: 0 Self preservation threshold: 50 Self preservation period: 90 Suspend threshold: 200 Suspend period: 30 Stream4_reassemble config: Server reassembly: INACTIVE Client reassembly: ACTIVE Reassembler alerts: ACTIVE Ports: 21 23 25 53 80 110 111 143 513 1433 Emergency Ports: 21 23 25 53 80 110 111 143 513 1433 http_decode arguments: Unicode decoding IIS alternate Unicode decoding IIS double encoding vuln Flip backslash to slash Include additional whitespace separators Ports to decode http on: 80 rpc_decode arguments: Ports to decode RPC on: 111 32771 alert_fragments: INACTIVE alert_large_fragments: ACTIVE alert_incomplete: ACTIVE alert_multiple_requests: ACTIVE telnet_decode arguments: Ports to decode telnet on: 21 23 25 119 Conversation Config: KeepStats: 0 Conv Count: 32000 Timeout : 60 Alert Odd?: 0 Allowed IP Protocols: All Portscan2 config: log: /var/log/snort/scan.log scanners_max: 3200 targets_max: 5000 target_limit: 5 port_limit: 20 timeout: 60 database: compiled support for ( oracle ) database: configured to use oracle database: user = snort database: password is set database: database name = dbprod database: sensor name = agcmint database: sensor id = 1 database: oracle_error: Error while trying to retrieve text for error ORA-01405 database: schema version = 106 database: using the "alert" facility 952 Snort rules read... 952 Option Chains linked into 129 Chain Headers 0 Dynamic rules +++++++++++++++++++++++++++++++++++++++++++++++++++ Rule application order: ->activation->dynamic->alert->pass->log --== Initialization Complete ==-- -*> Snort! <*- Version 2.0.0rc1 (Build 61) By Martin Roesch (roesch () sourcefire com, www.snort.org) database: oracle_error: Error while trying to retrieve text for error ORA-01403 database: oracle_error: ORA-01465: invalid hex number database: oracle_error: Error while trying to retrieve text for error ORA-01403 database: oracle_error: ORA-01465: invalid hex number database: oracle_error: Error while trying to retrieve text for error ORA-01403 database: oracle_error: ORA-01465: invalid hex number database: oracle_error: Error while trying to retrieve text for error ORA-01403 database: oracle_error: ORA-01465: invalid hex number I've tryed with all choice of encoding in snort.conf... please help me ----- Original Message ----- From: "Martin Roesch" <roesch () sourcefire com> To: <snort-users () lists sourceforge net>; <snort-devel () lists sourceforge net>; <snort-announce-admin () lists sourceforge net> Sent: Wednesday, March 26, 2003 10:48 PM Subject: [Snort-users] Snort 2.0 rc1 available
The Snort 2.0 release candidate 1 is available for your testing. We've been working on and tweaking Snort 2.0 for quite a while now and it's looking like it's ready to go. Please download it and check it out at the earliest opportunity. If you find any bugs, please read the doc/BUGS file before submitting a bug report, Snort works on too many platforms for us to guess at your configuration! This version features: * Higher performance (due to a new pattern matcher and rebuilt detection engine) * Better decoders * Enhanced stream reassembly and defragmentation * Tons of bug fixes * Updated rules * Updated snort.conf * New detection keywords (byte_test, byte_jump, distance, within) & stateful pattern matching * New HTTP flow analyzer * Enhanced anomaly detection (HTTP, RPC, TCP, IP, etc) * Better self preservation in stateful sunsystems * Xrefs fixed * Flexresp works faster and more effectively * Better chroot()'ing * Fixed 802.1q decoding * Better async state handling * New alerting option: -A cmg!! The source tarball is available at http://www.snort.org/dl/snort-2.0.0rc1.tar.gz. A win32 build will follow shortly! Brought to you by the character ':', the letters 'w' and 'q' and the number 0x41414141. Enjoy! -Marty -- Martin Roesch - Founder/CTO, Sourcefire Inc. - (410)290-1616 Sourcefire: Snort-based Enterprise Intrusion Detection Infrastructure roesch () sourcefire com - http://www.sourcefire.com Snort: Open Source Network IDS - http://www.snort.org ------------------------------------------------------- This SF.net email is sponsored by: The Definitive IT and Networking Event. Be There! NetWorld+Interop Las Vegas 2003 -- Register today! http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- This SF.net email is sponsored by: The Definitive IT and Networking Event. Be There! NetWorld+Interop Las Vegas 2003 -- Register today! http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort 2.0 rc1 available Martin Roesch (Mar 26)
- Re: Snort 2.0 rc1 available Rob Hughes (Mar 26)
- Re: Snort 2.0 rc1 available Paul B. Poh (Mar 27)
- Re: Snort 2.0 rc1 available Andrew R. Baker (Mar 27)
- Re: Snort 2.0 rc1 available Paul B. Poh (Mar 27)
- Re: Snort 2.0 rc1 available Master Brian (Mar 27)
- Re: Snort 2.0 rc1 available Bennett Todd (Mar 27)
- Snort 2.0 rc1 performances jeremy chartier (Mar 28)
- Snort 2.0 rc1 Observations Kenneth G. Arnold (Mar 28)
- Re: Snort 2.0 rc1 Observations Erek Adams (Mar 28)
- Re: Snort 2.0 rc1 Observations Kenneth G. Arnold (Mar 28)
- Re: Snort 2.0 rc1 Observations Erek Adams (Mar 28)
- Snort 2.0 rc1 Observations Kenneth G. Arnold (Mar 28)
- Re: Snort 2.0 rc1 Observations Chris Green (Mar 31)
- Snort 2.0 rc1 pass solved / now mysql problem Kenneth G. Arnold (Mar 31)
- Re: Snort 2.0 rc1 available Rob Hughes (Mar 26)
- Re: snort decoder Chris Green (Mar 28)