Definately need to upgrade versions.
You could also put the path that unicode.map is located on line 285. But I
suggest you just move it to the right place.
On Thu, Mar 08, 2007 at 06:31:11AM -0600, it looks like Patrick S. Harper sent
me:
> You need to use the latest version of Snort, and move the file from
> ~/snort-2.1.2/etc to /etc/snort
>
> > -----Original Message-----
> > From: snort-users-bounces@lists.sourceforge.net [mailto:snort-users-
> > bounces@lists.sourceforge.net] On Behalf Of taree ahmed
> > Sent: Thursday, March 08, 2007 5:25 AM
> > To: snort-users@lists.sourceforge.net
> > Subject: [Snort-users] Snort ids fatal error
> >
> > Hi,
> >
> > Dear team, could you please provide any clue in this regard
> > .Detail is as follows :
> >
> > whenever i try to run startup script for snort which is located in :
> > cd /etc/init.d/ , it doesnot start snort
> >
> > ./snort start
> >
> > Starting Intrusion Database System: SNORT
> >
> > no service is starting as confirmed from : ps -ax | grep snort
> >
> > if we further scrutinize to "cat snort", following command gives error
> > :
> >
> > $SNORT_PATH/snort -c $CONFIG -i $IFACE -g $SNORT_GID $OPTIONS
> >
> > what this command does is as follows :
> >
> > snort -c /etc/snort/snort.conf -i eth0 -g snort -D
> >
> > The output of this command is as follows :
> > -----------------------------------------------------------------------
> > -------------------------------
> > [root@localhost bin]# snort -c /etc/snort/snort.conf -i eth0 -g snort
> > Running in IDS mode
> > Log directory = /var/log/snort
> >
> > Initializing Network Interface eth0
> >
> > --== Initializing Snort ==--
> > Initializing Output Plugins!
> > Decoding Ethernet on interface eth0
> > Initializing Preprocessors!
> > Initializing Plug-ins!
> > Parsing Rules file /etc/snort/snort.conf
> >
> > +++++++++++++++++++++++++++++++++++++++++++++++++++
> > Initializing rule chains...
> > ,-----------[Flow Config]----------------------
> > | Stats Interval: 0
> > | Hash Method: 2
> > | Memcap: 10485760
> > | Rows : 4099
> > | Overhead Bytes: 16400(%0.16)
> > `----------------------------------------------
> > No arguments to frag2 directive, setting defaults to:
> > Fragment timeout: 60 seconds
> > Fragment memory cap: 4194304 bytes
> > Fragment min_ttl: 0
> > Fragment ttl_limit: 5
> > Fragment Problems: 0
> > Self preservation threshold: 500
> > Self preservation period: 90
> > Suspend threshold: 1000
> > Suspend period: 30
> > Stream4 config:
> > Stateful inspection: ACTIVE
> > Session statistics: INACTIVE
> > Session timeout: 30 seconds
> > Session memory cap: 8388608 bytes
> > State alerts: INACTIVE
> > Evasion alerts: INACTIVE
> > Scan alerts: INACTIVE
> > Log Flushed Streams: INACTIVE
> > MinTTL: 1
> > TTL Limit: 5
> > Async Link: 0
> > State Protection: 0
> > Self preservation threshold: 50
> > Self preservation period: 90
> > Suspend threshold: 200
> > Suspend period: 30
> > Stream4_reassemble config:
> > Server reassembly: INACTIVE
> > Client reassembly: ACTIVE
> > Reassembler alerts: ACTIVE
> > Zero out flushed packets: INACTIVE
> > flush_data_diff_size: 500
> > Ports: 21 23 25 53 80 110 111 143 513 1433
> > Emergency Ports: 21 23 25 53 80 110 111 143 513 1433
> > ERROR: /etc/snort/snort.conf(285) => Invalid file name for IIS Unicode
> > Map file.
> > Fatal Error, Quitting..
> > -----------------------------------------------------------------------
> > ------------------------------------------------
> >
> > Now, if we read line#285 of snort.conf as indicated by error , it
> > points to unicode.map
> >
> > line#284: preprocessor http_inspect: global \
> > line#285: iis_unicode_map unicode.map 1252
> >
> > unicode.map is located in cd ~/snort-2.1.2/etc and there seems nothing
> > wrong with this file.
> >
> > can you help me figure out problem ?
> >
> > thanks.
> >
> > tariq ahmad
> >
> > -----------------------------------------------------------------------
> > --
> > Take Surveys. Earn Cash. Influence the Future of IT
> > Join SourceForge.net's Techsay panel and you'll get the chance to share
> > your
> > opinions on IT & business topics through brief surveys-and earn cash
> > http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVD
> > EV
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users@lists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
>
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share your
> opinions on IT & business topics through brief surveys-and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
+---------------------------------------------------------------------+
Joel Esler Security Consultant
gpg key: http://demo.sourcefire.com/jesler.pgp.key
+---------------------------------------------------------------------+
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
|