RE: ERROR: unknown preprocessor "http_decode"

["Schmehl, Paul L" <pauls () utdallas edu>]

> -----Original Message-----
> From: snort-users-admin () lists sourceforge net 
> [mailto:snort-users-admin () lists sourceforge net] On Behalf Of 
> Warner Joseph
> Sent: Friday, January 16, 2004 1:39 PM
> To: 'snort-users () lists sourceforge net'
> Subject: [Snort-users] ERROR: unknown preprocessor "http_decode"
>
> It's been a while since I've had to ask for help here but I 
> just upgraded from snort-2.0.5 to v2.1.0 and I'm getting this 
> error when I attempt to start snort:
>
> ERROR:  unknown preprocessor "http_decode"
> Fatal Error, Quitting..
http_decode is gone.  It has been replaced by http_inspect.  Make sure
you read /usr/local/share/doc/snort/README.http_inspect carefully, as
some settings can generate a *boatload* of traffic.  See the thread I
started on this subject just a few days ago.

> If I comment out the whole http_decode preprocessor line in 
> my snort.conf then it starts and runs fine.
That's because http_decode no longer exists, as the error in the
messages log is telling you.
 
> I'm running snort on FreeBSD so when I upgrade I usually use 
> portupgrade to do the upgrade via ports and then edit the new 
> copy of snort.conf in /usr/local/share/snort and copy it over 
> my old .conf file in /usr/local/etc  I've done it this way 
> including manually editing my .rules files for quite some 
> time and haven't ever experienced any problems..until now.
That's precisely how I upgrade mine as well - using portupgrade.
 
> Can anyone help?
Hopefully I have.  If you have specific questions, feel free to email
me.  I'm running FreeBSD 4.9 RELEASE, snort-2.1.0, mysql and acid, all
on the same box.

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/ 


-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users