Re: snort process getting killed

[Nigel Houghton <nigel () sourcefire com>]

On  0, Todd Wease <twease () sourcefire com> wrote:
> doug schmidt wrote:
> > Will test with ac-bnfa; right now running with acs
> >
> > Here is some config's: (removed IP's in var's)
>
> > preprocessor telnet_decode
>
> Sorry, should have caught this before.  The telnet_decode preprocessor
> has been deprecated in favor the the ftp_telnet dynamic preprocessor.
> Again, take a look at the default snort.conf and README.ftptelnet (in
> docs/).

I suspect the use of a very old snort.conf. I suggest using the
snort.conf in the tarball for the version of snort you are running
(2.6.1.5), you will of course, have to edit to suit your environment.

It may seem like a pain, but I suspect it will save you a lot of time in
the future.

-- 
Nigel Houghton
Office Linebacker
SF VRT

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users