[Snort-devel] Snort 2.9.1.1 ERROR - SF_REPUTATION

Russ Combs rcombs at ...402...
Fri Oct 7 06:52:13 EDT 2011


The size mismatch means you have the new Snort binary and an old
preprocessor so.  Try make uninstall-ing your old Snort and reinstalling the
new one.  Or use a different --prefix to avoid mingling stuff.

On Fri, Oct 7, 2011 at 5:55 AM, Edward Fjellskål <edwardfjellskaal at ...2840...9...
> wrote:

>
> Hi,
>
> I compile it, and try to start it:
>
> ....
> ERROR size 396 != 376
> ERROR: Failed to initialize dynamic preprocessor: SF_REPUTATION (IPV6)
> version 1.1.1 (-2)
>
> strace shows me:
> ...
> write(2, "    alert_multiple_requests: INA"..., 38
> alert_multiple_requests: INACTIVE
> ) = 38
> fstat64(1, {st_mode=S_IFCHR|0600, st_rdev=makedev(136, 11), ...}) = 0
> mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
> 0) = 0xb5e87000
> write(1, "ERROR size 396 != 376\n", 22ERROR size 396 != 376
> ) = 22
> write(2, "ERROR: Failed to initialize dyna"..., 90ERROR: Failed to
> initialize dynamic preprocessor: SF_REPUTATION (IPV6) version 1.1.1 (-2)
> ) = 90
> write(2, "Fatal Error, Quitting..\n", 24Fatal Error, Quitting..
> ) = 24
> exit_group(1)                           = ?
>
>
> E
>
>
> On 10/07/2011 03:55 AM, Snort Releases wrote:
> > Snort 2.9.1.1 is now available on snort.org, at
> > http://www.snort.org/snort-downloads/ in the Latest Release section.
> >
> > 2.9.0 RC&  later packages are signed with a new PGP key
> > (that is signed with the previous key).
> >
> > ****
> > NOTE: Snort 2.9.1 and later requires pkg-config be installed for
> > some of its autoconf processing.
> > ****
> > 2011-10-05 - Snort 2.9.1.1
> >
> > [*] New Additions
> >     * Added the ability to use shared memory (linux only) for the
> >       experimental IP reputation preprocessor. See README.reputation
> >       for details.
> >
> >     * Added a Unix control socket (linux only), used to issue commands
> >       to running Snort processes. Currently, it is only used by the IP
> >       Reputation preprocessor for communication regarding the shared
> >       memory.  See the Snort Manual and the tools/control directory for
> >       more details.
> >
> > [*] Improvements
> >     * Improved HTTP Inspect and rule processing for both raw compress
> >       and zlib deflated data. Expanded coverage of normalization for
> >       Unicode encoded data.
> >
> >     * Updated HTTP Inspect PAF support to better handle HTTP 1.1
> >       responses.
> >
> > Please see the Release Notes and ChangeLog for more details.
> >
> > Please submit bugs, questions, and feedback to bugs at ...2256...
> >
> > Happy Snorting!
> > The Snort Release Team
> >
> >
> >
> ------------------------------------------------------------------------------
> > All of the data generated in your IT infrastructure is seriously
> valuable.
> > Why? It contains a definitive record of application performance, security
> > threats, fraudulent activity, and more. Splunk takes this data and makes
> > sense of it. IT sense. And common sense.
> > http://p.sf.net/sfu/splunk-d2dcopy2
> > _______________________________________________
> > Snort-devel mailing list
> > Snort-devel at lists.sourceforge.net
> > https://lists.sourceforge.net/lists/listinfo/snort-devel
> >
> > Please visit http://blog.snort.org for the latest news about Snort!
>
>
>
> ------------------------------------------------------------------------------
> All of the data generated in your IT infrastructure is seriously valuable.
> Why? It contains a definitive record of application performance, security
> threats, fraudulent activity, and more. Splunk takes this data and makes
> sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-d2dcopy2
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
>
> Please visit http://blog.snort.org for the latest news about Snort!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20111007/072fa213/attachment.html>


More information about the Snort-devel mailing list