Re: Fatal error when starting snort on the sensor

[Matt Kettler <mkettler () evi-inc com>]

At 02:11 PM 9/17/2004, Juan Fernandez wrote:
> Sep 17 21:02:54 sensjrlan snort: FATAL ERROR: /etc/snort/snort.conf(458) 
> => Unknown rule type: ports
>
> In snort.conf the 458 line is this:
>
> output database: alert, mysql, user=snort password=snort dbname=snort 
> host=208.170.171.199 sensor_name=sensjrlan

I suspect snort's parser is a bit confused, so I doubt the error reported 
is on that line. After all, it doesn't contain the word "ports" nor any 
variables which could expand to contain ports.

Check around for lines that begin with ports in your snort.conf, but treat 
the line number provided by snort as inaccurate.

try this for starters:
        grep ports snort.conf




-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users