Re: snort and snortsam

[Frank Knobbe <frank () knobbe us>]

On Mon, 2004-04-19 at 16:31, snort teste wrote:
> i upgraded my snort's version to 2.1.2, and recompiled the snort to support 
> the snortsam.
> when i reinitialize the snortsam the bellow message is showed:
>
> 2004/04/19, 17:32:49, -, 1, snortsam, Starting to listen for Snort alerts.
> 2004/04/19, 17:37:13, 10.12.0.15, 1, snortsam, Snort station 10.12.0.15 
> using wrong password, trying to re-sync.


Looks like you restarted Snortsam but not Snort. In that case, on the
first block request, Snort will use the previously negotiated password,
not the initial one Snortsam is expecting. On that block, both Snort and
Snortsam will renegotiate encryption keys and continue with their
business.

So this is not an error per se. It's merely a note. If you do not
restart either one of them, and then you see errors like this, it may be
because you have a second instance of Snort started, or someone is
trying to insert himself between Snort and Snortsam. 

If you kill Snort without shutting it down gracefully, you will get this
warning once as well.

Hope this helps,
Frank

PS: You might want to post Snortsam related issues to the
discussion () snortsam net mail lists, and not bore the Snort users here :)

-- 
Warning at the Gates of Bill:  
Abandon hope, all ye who press <ENTER> here...

Attachment: signature.asc
Description: This is a digitally signed message part