[Snort-users] RE: Parse Error

Erek Adams erek at ...577...
Tue Oct 9 13:22:11 EDT 2001


On Tue, 9 Oct 2001, Gray . Brendan wrote:

> According to the snort website, those rules are for the Snort in current
> development (CVS) and may not work with 1.8.1.  I thought I'd give them a
> try anyway, and here's what I got.
>
> Error: OpenPcap() FSM compilation failed:
> 	 parse error
> PCAP command:  /etc/snort/rules/snort.conf
>
> Fatal Error, Quitting..
>
> I do have libpcap installed, and snort works fine with my older rules files.
> So I guess I'm stuck using the whitehats vision18.conf from late August, at
> least for a while yet.

It's the way oou are starting snort.  I'd bet you have "-dv"
/etc/snort/rules/snort.conf instead of "-dvc".  -c _must_ be followed by the
config file, and the reverse is true:  config file must be preceded by -c.

Hope that helps!

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net






More information about the Snort-users mailing list