Snort - [Snort-users] Fatal error when starting snort on the sensor

Author

[Snort-users] Fatal error when starting snort on the sensor

Juan Fernandez

2004-09-22, 10:25 pm

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------_=_NextPart_001_01C49CE1.B7DB9507
Content-Type: text/plain

Hi Guys!!

When I start snort manually from the command line /etc/init.d/snort start I
see that snort starts:

Starting Intrusion Database System: SNORT

SNORT is up and running!

On /var/log/messeges I see:

Sep 17 21:02:54 sensjrlan snort: FATAL ERROR: /etc/snort/snort.conf(458) =>
Unknown rule type: ports

In snort.conf the 458 line is this:

output database: alert, mysql, user=snort password=snort dbname=snort
host=208.170.171.199 sensor_name=sensjrlan

Mysql and acid are on another server (208.170.171.199) I checked that I can
telnet to port 3306 so what's wrong ?

Thanks very much!!!

------_=_NextPart_001_01C49CE1.B7DB9507
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable

<html xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns=3D"http://www.w3.org/TR/REC-html40">

<head>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">

<meta name=3DGenerator content=3D"Microsoft Word 11 (filtered medium)">
<style>

</style>

</head>

<body lang=3DEN-US link=3Dblue vlink=3Dpurple>

<div class=3DSection1 dir=3DRTL>

Hi
Guys!!    <o:p></o:p>

<o:p> </o:p></f=
ont>

When
I start snort manually from the command line /etc/init.d/snort start I =
see that
snort starts:<o:p></o:p>

<o:p> </o:p></f=
ont>

Starting
Intrusion Database System: SNORT<o:p></o:p></=
p>

SNORT
is up and running!<o:p></o:p>

<o:p> </o:p></f=
ont>

On
/var/log/messeges I see:<o:p></o:p>

 <o:p></o:p></f=
ont>

Sep
17 21:02:54 sensjrlan snort: FATAL ERROR: /etc/snort/snort.conf(458) =
=3D> Unknown
rule type: ports<o:p></o:p>

<o:p> </o:p></f=
ont>

In
snort.conf the 458 line is this:<o:p></o:p>

<o:p> </o:p></f=
ont>

output
database: alert, mysql, user=3Dsnort password=3Dsnort dbname=3Dsnort =
host=3D208.170.171.199
sensor_name=3Dsensjrlan<o:p></o:p>

<o:p> </o:p></f=
ont>

Mysql
and acid are on another server (208.170.171.199) I checked that I can =
telnet to
port 3306 so what's wrong ?<o:p></o:p>

<o:p> </o:p></f=
ont>

Thanks
very much!!!<o:p></o:p>

<o:p> </o:p></f=
ont>

<o:p> </o:p>

</div>

</body>

</html>

------_=_NextPart_001_01C49CE1.B7DB9507--

-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users

sekure

2004-09-22, 10:25 pm

I would look for the word "ports" in your snort.conf. Discounting all
the comments, there is only one place that I have the word "ports" in
my snort.conf, and that's where I define http_inspect preprocessor.

So go there and make sure that if you commented out http_inspect, you
also commented out everything below it. Or if it isn't uncommented,
make sure that there is a "\" character at the end of the line
directly above the line starting with "ports"

So, either this:
preprocessor http_inspect_server: server default \
ports { 80 8080 }

Or this:
# preprocessor http_inspect_server: server default \
# ports { 80 8080 }

NOT THIS:
preprocessor http_inspect_server: server default <--*****BACKSLASH MISSING****
ports { 80 8080 }

----- Original Message -----
From: Juan Fernandez <juan.fernandez@deltathree.com>
Date: Fri, 17 Sep 2004 21:11:13 +0300
Subject: [Snort-users] Fatal error when starting snort on the sensor
To: "snort-users@lists.sourceforge.net" <snort-users@lists.sourceforge.net>

Hi Guys!!

When I start snort manually from the command line /etc/init.d/snort
start I see that snort starts:

Starting Intrusion Database System: SNORT

SNORT is up and running!

On /var/log/messeges I see:

Sep 17 21:02:54 sensjrlan snort: FATAL ERROR:
/etc/snort/snort.conf(458) => Unknown rule type: ports

In snort.conf the 458 line is this:

output database: alert, mysql, user=snort password=snort dbname=snort
host=208.170.171.199 sensor_name=sensjrlan

Mysql and acid are on another server (208.170.171.199) I checked that
I can telnet to port 3306 so what's wrong ?

Thanks very much!!!

-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users

Matt Kettler

2004-09-22, 10:25 pm

At 02:11 PM 9/17/2004, Juan Fernandez wrote:
>Sep 17 21:02:54 sensjrlan snort: FATAL ERROR: /etc/snort/snort.conf(458)
>=> Unknown rule type: ports
>
>In snort.conf the 458 line is this:
>
>output database: alert, mysql, user=snort password=snort dbname=snort
>host=208.170.171.199 sensor_name=sensjrlan

I suspect snort's parser is a bit confused, so I doubt the error reported
is on that line. After all, it doesn't contain the word "ports" nor any
variables which could expand to contain ports.

Check around for lines that begin with ports in your snort.conf, but treat
the line number provided by snort as inaccurate.

try this for starters:
grep ports snort.conf

-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users