Snort mailing list archives
Testing 2.9.1 and getting 'Unknown preprocessor: "sip"'
From: Miguel Alvarez <miguellvrz9 () gmail com>
Date: Thu, 15 Sep 2011 17:33:36 -0600
I'm finally getting around to testing 2.9.1 but when I test my updated snort.conf, I'm getting 'Unknown preprocessor: "sip"': # which snort /usr/sbin/snort # /usr/sbin/snort -V ,,_ -*> Snort! <*- o" )~ Version 2.9.1 IPv6 GRE (Build 71) '''' By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team Copyright (C) 1998-2011 Sourcefire, Inc., et al. Using libpcap version 1.1.1 Using PCRE version: 6.6 06-Feb-2006 Using ZLIB version: 1.2.3 # /usr/sbin/snort -c /etc/snort.test/snort.conf -T ... ERROR: /etc/snort.test/snort.conf(459) Unknown preprocessor: "sip". Fatal Error, Quitting.. And here's the sip preprocessor section from snort.conf (should be exactly the same from the stock 2.9.1 snort.conf): # SIP Session Initiation Protocol preprocessor. For more information see README.sip preprocessor sip: max_sessions 40000, \ ports { 5060 5061 5600 }, \ methods { invite \ cancel \ ack \ bye \ register \ options \ refer \ subscribe \ update \ join \ info \ message \ notify \ benotify \ do \ qauth \ sprack \ publish \ service \ unsubscribe \ prack }, \ max_uri_len 512, \ max_call_id_len 80, \ max_requestName_len 20, \ max_from_len 256, \ max_to_len 256, \ max_via_len 1024, \ max_contact_len 512, \ max_content_len 2048 This is on CentOS 5.6. The only google result for this was from a Japanese IRC chat and it didn't make any sense. :-( They also happened to be running CentOS but I doubt that's the problem. It was compiled with the following options (from the provided .spec file): SNORT_BASE_CONFIG="--prefix=%{_prefix} \ --bindir=%{_sbindir} \ --sysconfdir=%{_sysconfdir}/snort \ --enable-decoder-preprocessor-rules \ --enable-targetbased \ --enable-zlib \ --enable-sourcefire \ --enable-ipv6 \ --enable-perfprofiling \ --enable-gre \ --enable-ppm \ --enable-normalizer \ --enable-reload" Does anyone have any suggestions? Thank you ------------------------------------------------------------------------------ BlackBerry® DevCon Americas, Oct. 18-20, San Francisco, CA http://p.sf.net/sfu/rim-devcon-copy2 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Testing 2.9.1 and getting 'Unknown preprocessor: "sip"' Miguel Alvarez (Sep 15)