Re: ERROR: Please activate spp_conversation before trying to activate spp_portscan2

[Neil Dickey <neil () geol niu edu>]

Kit Massengill <KitM () FirstEquipment com> wrote asking:

> Here's what happens when I try to start Snort now:
>
> ...snip...
>
> ERROR: Please activate spp_conversation before trying to activate
> spp_portscan2
> Fatal Error, Quitting..
> [FAILED]

I think this means that you have to have a line like this ...

  preprocessor conversation: allowed_ip_protocols all, \
     timeout 60, max_conversations 3000

... just above this line ...

  preprocessor portscan2: scanners_max 256, targets_max 1024, \
     target_limit 5, port_limit 20, timeout 60, log \
     /var/snort/snort_portscan.log

... in your snort.conf file.  Perhaps you deleted it or commented
it out?  The backslashes mean that the arguments should be read as
part of one single line of text.

I hope this helps.

Best regards,

Neil Dickey, Ph.D.
Research Associate/Sysop
Geology Department
Northern Illinois University
DeKalb, Illinois
60115


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users