Snort mailing list archives
Re: Could not read appName. Line Snort Differs AppKey
From: Damian Torres via Snort-users <snort-users () lists snort org>
Date: Fri, 3 Aug 2018 12:00:11 -0400
Mike, I removed the -q option. Here's the full output from the AppId Configuration: ================================================= AppId Configuration Detector Path: /usr/local/lib appStats Files: appstats-u2.log appStats Period: 60 secs appStats Rollover Size: 20971520 bytes appStats Rollover time: 86400 secs Defaulting to monitoring all Snort traffic for AppID. Adding 0x00000000-0xFFFFFFFF (0x00000038) with zone -1 Adding ::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff (0x00000038) with zone -1 AppInfo: AppId 4109 is UNKNOWN AppInfo: AppId 4043 is UNKNOWN AppInfo: AppId 473 is UNKNOWN AppInfo: AppId 4385 is UNKNOWN AppInfo: AppId 4387 is UNKNOWN AppInfo: AppId 4387 is UNKNOWN Invalid direct client application AppId, 4075, for 0x7f97c78ec700 0x5599a3133e00 AppInfo: AppId 4075 is UNKNOWN AppInfo: AppId 503 is UNKNOWN AppInfo: AppId 503 is UNKNOWN AppInfo: AppId 503 is UNKNOWN AppInfo: AppId 503 is UNKNOWN Invalid direct client application AppId, 2634, for 0x7f97c78ec700 0x5599a314cbc0 AppInfo: AppId 2634 is UNKNOWN AppInfo: AppId 4115 is UNKNOWN AppInfo: AppId 4385 is UNKNOWN AppInfo: AppId 4387 is UNKNOWN Invalid direct client application AppId, 4126, for 0x7f97c78ec700 0x5599a3198520 AppInfo: AppId 4126 is UNKNOWN 3rd Party Dir: /usr/local/lib/thirdparty Monitoring Networks for any zone: 0.0.0.0-255.255.255.255 0038 ::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff 0038 Excluded TCP Ports for Src: Excluded TCP Ports for Dst: Excluded UDP Ports Src: Excluded UDP Ports Dst: WARNING: Directory /usr/local/lib/thirdparty does not exist. ================================================= I also attached the full output, just in case. Warm Regards, Damian On Fri, Aug 3, 2018 at 10:31 AM, Mike Stepanek (mstepane) < mstepane () cisco com> wrote:
There was a similar discussion here... but it was never really conclusive whether that was the actual fatal error or not: https://lists.snort.org/pipermail/snort-users/2018-July/071578.html Would you be able to post the entire output from Snort, so we can take more of a look? FYI, to fix that one issue, you can just remove the bogus first line of appMapping.data from your ODP install. - Mike Stepanek mstepane () cisco com *From: *Snort-users <snort-users-bounces () lists snort org> on behalf of Damian Torres via Snort-users <snort-users () lists snort org> *Reply-To: *Damian Torres <datorr2 () gmail com> *Date: *Thursday, August 2, 2018 at 8:55 PM *To: *Snort-Users <snort-users () lists snort org> *Subject: *[Snort-users] Could not read appName. Line Snort Differs AppKey Greetings. I am currently working on trying to add OpenAppID support for my Snort installation, and I think I almost have it working. However, I am receiving these errors and I'm not sure what to do to fix. === Error Output === Could not read appName. Line Snort Differs AppKey vmware-remote-auth -> vmware-remote-a AppInfo: AppId 4109 is UNKNOWN AppInfo: AppId 4043 is UNKNOWN AppInfo: AppId 503 is UNKNOWN AppInfo: AppId 503 is UNKNOWN AppInfo: AppId 503 is UNKNOWN AppInfo: AppId 503 is UNKNOWN AppInfo: AppId 473 is UNKNOWN AppInfo: AppId 4385 is UNKNOWN AppInfo: AppId 4387 is UNKNOWN AppInfo: AppId 4387 is UNKNOWN AppInfo: AppId 4385 is UNKNOWN AppInfo: AppId 4387 is UNKNOWN AppInfo: AppId 4115 is UNKNOWN Invalid direct client application AppId, 4126, for 0x7f9850a09700 0x5603a0b58520 AppInfo: AppId 4126 is UNKNOWN Invalid direct client application AppId, 4075, for 0x7f9850a09700 0x5603a0af3e00 AppInfo: AppId 4075 is UNKNOWN Invalid direct client application AppId, 2634, for 0x7f9850a09700 0x5603a0b0cbc0 AppInfo: AppId 2634 is UNKNOWN ==================== I have Google'd this and haven't been able to find anything, other than someone else having a similar issue a few months ago, who received no response. http://seclists.org/snort/2018/q2/336 Any help would be much appreciated. Thank you. Warm Regards, Damian
Attachment:
snort_output.txt
Description:
_______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: snort-users-leave () lists snort org Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
Current thread:
- Could not read appName. Line Snort Differs AppKey Damian Torres via Snort-users (Aug 03)
- Re: Could not read appName. Line Snort Differs AppKey Mike Stepanek (mstepane) via Snort-users (Aug 06)
- Re: Could not read appName. Line Snort Differs AppKey Damian Torres via Snort-users (Aug 06)
- Re: Could not read appName. Line Snort Differs AppKey Mike Stepanek (mstepane) via Snort-users (Aug 06)