Re: New Version

[Jeremy Hewlett <jh () sourcefire com>]

On Thu, Dec 18, Timm Schneider wrote:
> I installed the new version.
> After that is start snort and then there will be an error messages
> that says /etc/snort/snort.conf (291) invalid File name for IIS unicade Map  
> file.
>
> What is wrong?

In the default snort.conf:

282 # unicode.map should be wherever your snort.conf lives, or given
283 # a full path to where snort can find it.

You need to move unicode.map into your snort conf dir, or give a full
path name. unicode.map is in the <snort src>/etc directory. What
you're looking for is the line that reads like:

284 preprocessor http_inspect: global \
285     iis_unicode_map unicode.map 1252


You should also take a look at the snort user manual for HttpInspect
before really digging into it (if you haven't already).




-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users