[Snort-devel] Problems after 1.8.3 upgrade to 1.8.6

Michael Lafreniere mlafren at ...1261...
Fri Apr 12 15:58:02 EDT 2002

/root/rules is a directory containing all the *.rules files and 
snort.conf.  This is how the last guy had it setup so figured I wouldn't 
mess with what's working.  I've also run it /usr/local/bin/snort -
c /root/rules/*.rules -T just incase this made a diff (thought of it just 
now) and same error.

I'll search the files tomorrow, going home now I think.  Thanks very much 
for the help.


On Fri, 12 Apr 2002, Michael Lafreniere wrote:

> Ok ran it with -T and got:


> ERROR line /root/rules (1) => Unknown rule type: ��

OK, I'm guessing, but...

Something is corrupt somewhere.  :-/  The little "u" thingie isn't normal, 
I didn't get it when I upgraded from the same tar.gz.

Try this:

	vi snort.conf
	:set list

That might show you if there are any wierd characters in that file.  Then
check each of your included rules files the same way.


> Commenting out this line returns same error.  I've recompiled the source
> code from the fresh tar.gz file I downloaded off the snort site and also
> returns same error.
> I also cannot run the old snort, 1.8.3 I did a fresh recompile of it and
> it now comes up with the same errors.

The more you describe it, the more it points towards a odd character in a
.conf or a .rules file.  I hate to say it, but you're going to have to 
them all to be safe.

Ummmm...  And on a side note:  /root/rules _is_ a file and isn't a dir or
symlink right?


Erek Adams

More information about the Snort-devel mailing list