Snort mailing list archives
Re: shellcode error
From: john <john () bad-current net>
Date: Fri, 31 May 2002 10:46:51 -0400
Shouldn't additions to snort.conf like this be limited to the -CURRENT branch? On 0, matt <mkettler () evi-inc com> wrote:
Yeah, and the latest snort rules tarball should also include a snort.conf containing a SHELLCODE_PORTS variable.. put that in your snort.conf and it should work fine. Don't assume that the baseline snort.conf is unchanged when updating your rule sets, it is VERY common for it to have new variables used by the new ruleset. At 04:25 PM 5/30/2002 -0400, Hugo Ferr wrote:Downloaded latest stable rules for Snort 1.8.6, when I stort snort I get the following; [!] ERROR ./snortrules/shellcode.rules(14) => Bad port number: "(msg:"SHELLCODE" Fatal Error, Quitting.. The only thing I've found on the web suggests: "Probably your variable SHELLCODE_PORTS is not defined or misconfigured in snort.conf file." I don't have this variable in snort.conf (When I disable shellcode rules snort starts fine, but....what the hell..it should work with those rules as well :-) _______________________________________________________________ Don't miss the 2002 Sprint PCS Application Developer's Conference August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users_______________________________________________________________ Don't miss the 2002 Sprint PCS Application Developer's Conference August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
-- john () bad-current net publickey: http://www.bad-current.net/~john/key.html fingerprint: 7A96 24BE F9B1 1092 B4F6 B53D 1DB4 139B F217 DE50 _______________________________________________________________ Don't miss the 2002 Sprint PCS Application Developer's Conference August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- shellcode error Hugo Ferr (May 30)
- RE: shellcode error bthaler (May 30)
- Re: shellcode error Hugo Ferr (May 30)
- Re: shellcode error Erek Adams (May 30)
- Re: shellcode error Hugo Ferr (May 31)
- Re: shellcode error Erek Adams (May 31)
- Re: shellcode error Hugo Ferr (May 31)
- Re: shellcode error Hugo Ferr (May 30)
- RE: shellcode error bthaler (May 30)
- Re: shellcode error john (May 31)
- Re: shellcode error Erek Adams (May 31)
- Re: shellcode error Matt Kettler (May 31)