Re: (no subject)

[Matthew Watchinski <mwatchinski () sourcefire com>]

Can you send in the following.

The output from "pcre-config --version"
What version of snort your running
Did you compile snort from source?
What OS are you on.
The sid and rev of the rule on line 661,664,701
Did you compile pcre from source?

We've had a couple emails on this and it looks like some platforms have
a really old / broken libpcre on them that doesn't support named captures.

Something you can try is downloading the source packages for pcre from
www.pcre.org and building and installing them.  Then rebuilding snort

I've tested 6.5,6.6,7.0 and they all work when built from source.

Cheers,
-matt

Zultan wrote:
> When running #snort -Tc /etc/snort/snort.cong on the latest VRT rules update (2007-04-10), prce complains.  Here are 
> the first 3 that fail.  There are many others that fails in web-client.rules.  My pcre version is 6.6
>
>
> ERROR: /etc/snort/web-client.rules(661) : pcre compile of 
> "1([^>]\x00)*1(?P<q2>\x22\x00|\x27\x00|)1({\x00)?1(}\x00)?(?P=q2)(?=\s\x00|>\x00)" failed at offset 
> 15 : unrecognized character after (?
> Fatal Error, Quitting..
>
> ERROR: /etc/snort/web-client.rules(664) : pcre compile of 
> "1([^>]\x00)*1(?P<q2>\x22\x00|\x27\x00|)1({\x00)?1(}\x00)?(?P=q2)(?=\s\x00|>\x00)" failed at offset 
> 15 : unrecognized character after (?
> Fatal Error, Quitting..
>
> ERROR: /etc/snort/web-client.rules(701) : pcre compile of 
> "1([^>]\x00)*1(?P<q3>\x22\x00|\x27\x00|)1({\x00)?1(}\x00)?(?P=q3)(?=\s\x00|>\x00)" failed at offset 
> 15 : unrecognized character after (?
> Fatal Error, Quitting..
>
>
> Z
>
> =
> Search for products and services at: 
> http://search.mail.com
>
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share your
> opinions on IT & business topics through brief surveys-and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users