Re: ERROR: Preprocessor already registered with ID 21

[Russ Combs <rcombs () sourcefire com>]

On Fri, Aug 27, 2010 at 9:54 PM, waldo kitty <wkitty42 () windstream net>wrote:

> On 8/26/2010 19:07, Russ Combs wrote:
> > On Thu, Aug 26, 2010 at 6:44 PM, Richard Martin <
> richard.martin1980 () gmail com
> > <mailto:richard.martin1980 () gmail com>> wrote:
> >
> >     ERROR: Preprocessor already registered with ID 21
> >     Fatal Error, Quitting..
> >
> >     Any ideas?
> >
> > Looks like you've got two or more of preprocessor X lines in your conf
> (ie the
> > same one repeated).  Not sure which though.
>
> shouldn't snort tell which preprocessor it is? ;)

Yeah - you would think - but the Snort code doesn't facilitate that.
Looking into why that isn't provided I realized my earlier thought wasn't
correct:

* If you have two preprocessor X lines you will get a preprocessor specific
error message.

* If the RegisterPreprocessor function is called more than once for a given
preprocessor, you get "Duplicate preprocessor keyword: <name>".

* If the registered init function installs a preprocessor function twice, or
two different preprocessors try to install an API function with the same
preprocessor ID, you will get "Preprocessor already registered with ID
<id>".

My guess is that in this case a new preprocessor was created that uses the
same ID as another.



> ------------------------------------------------------------------------------
> Sell apps to millions through the Intel(R) Atom(Tm) Developer Program
> Be part of this innovative community and reach millions of netbook users
> worldwide. Take advantage of special opportunities to increase revenue and
> speed time-to-market. Join now, and jumpstart your future.
> http://p.sf.net/sfu/intel-atom-d2d
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------
Sell apps to millions through the Intel(R) Atom(Tm) Developer Program
Be part of this innovative community and reach millions of netbook users 
worldwide. Take advantage of special opportunities to increase revenue and 
speed time-to-market. Join now, and jumpstart your future.
http://p.sf.net/sfu/intel-atom-d2d

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users