Re: Unknown class type

[Michael Lubinski <michael.lubinski () gmail com>]

Even with all three of the rules not commented out,

preprocessor.rules
decoder.rules
sensitive-data.rules

I still get the error.


On Mon, Feb 7, 2011 at 7:29 AM, Alex Kirk <akirk () sourcefire com> wrote:

> You don't have the Sensitive Data preprocessor enabled. Either turn it on,
> or comment out all rules with a classtype of "sdf".
>
> On Mon, Feb 7, 2011 at 8:24 AM, Michael Lubinski <
> michael.lubinski () gmail com> wrote:
>
> > When I start snort with snort -c /etc/snort/snort.conf -i eth0 I get an
> > error stating
> >
> > "error: /etc/snort/rules/preproc_rules/preprocessor.rules(175) unknown
> > clastype; sdf
> >
> > My snort was working good, then I wanted to integrate the ET rules and now
> > I am having issues again. Any help would be appreciated.
> >
> > *classification.config is is in my snort.conf.
> >
> >
> > ------------------------------------------------------------------------------
> > The modern datacenter depends on network connectivity to access resources
> > and provide services. The best practices for maximizing a physical
> > server's
> > connectivity to a physical network are well understood - see how these
> > rules translate into the virtual world?
> > http://p.sf.net/sfu/oracle-sfdevnlfb
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
>
> --
> Alex Kirk
> AEGIS Program Lead
> Sourcefire Vulnerability Research Team
> +1-410-423-1937
> alex.kirk () sourcefire com
------------------------------------------------------------------------------
The modern datacenter depends on network connectivity to access resources
and provide services. The best practices for maximizing a physical server's
connectivity to a physical network are well understood - see how these
rules translate into the virtual world? 
http://p.sf.net/sfu/oracle-sfdevnlfb

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users