Snort mailing list archives
Re: SnortCenter and the Snort2.0 fixes
From: Michael <snorter () gmx net>
Date: Wed, 18 Jun 2003 10:50:53 +0200 (MEST)
Hi, I've exactly the same problem with Snortcenter v1.0rc1 and Snort 2.0.0. It's no problem to start Snort 2.0.0 with the original snort.conf. But if I use the snort.eth0.conf I get the following error message: ERROR: ERROR /etc/snort/snort.eth0.conf (88): Bad arguments to byte_test: Fatal Error, Quitting.. Did you find a solution for this? Is there a fix for Snortcenter? Best regards Michael
I'm using Snort 2 and Snortcenter 1RC1 and i'm having lots of problems. The rules with the option byte_test are with some kind of error - i think it's the empty byte_test : alert ip $HOME_NET any -> $EXTERNAL_NET any( sid: 1882; rev: 9; msg: "ATTACK-RESPONSES id check returned userid"; content: " gid="; distanc e: 0; within: 15; byte_test: ; byte_test: 5,<,65537,0,relative,string; content: "uid="; byte_test: 5,<,65537,0,relative,string; classtype: bad-unknown;) .. and when i try to edit the rule, the form only allow to edit these options: Category,SID,REV,Rule Name,Action,Proto,Source IP,Source Port,Destination IP and Destination Port... So, how will i edit existing rules? someone else with the same problem? or similar? -- Daniel A. Melo Consultor em Segurança da Tecnologia da Informação MCSO - Modulo Certified Security Officer Em Seg, 2003-06-16 às 04:43, Joerg Weber escreveu:Hello, did someone download SnortCenter recently and figured out wether the fixes for it provided by Roy S. Rapoport were included? I'm not feeling like installing and configuring it again just to see they are not; SnortCenter's homepage doesn't mention anything new aboutit. Thanks, Joerg------------------------------------------------------- This SF.Net email is sponsored by: INetU Attention Web Developers & Consultants: Become An INetU Hosting Partner. Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission! INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive:
-- +++ GMX - Mail, Messaging & more http://www.gmx.net +++ Bitte lächeln! Fotogalerie online mit GMX ohne eigene Homepage! ------------------------------------------------------- This SF.Net email is sponsored by: INetU Attention Web Developers & Consultants: Become An INetU Hosting Partner. Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission! INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- SnortCenter and the Snort2.0 fixes Joerg Weber (Jun 16)
- Re: SnortCenter and the Snort2.0 fixes Daniel A. Melo (Jun 17)
- Re: SnortCenter and the Snort2.0 fixes Brian (Jun 17)
- Re: SnortCenter and the Snort2.0 fixes Michael (Jun 18)
- Re: SnortCenter and the Snort2.0 fixes Roy S. Rapoport (Jun 18)
- Re: SnortCenter and the Snort2.0 fixes Daniel A. Melo (Jun 17)