[Snort-users] bad priority messages

John Sage jsage at ...2022...
Sun Mar 24 16:52:02 EST 2002


I haven't been doing well in answering questions, today, but how's
this set:

<snip>
#
# Include classification & priority settings
# 

include classification.config
#
<snip>

in your snort.conf?

If memory servers, this has to be on, if not, I believe you get just
the sort of errors you're seeing..

..I'll go back to sleep, now.


- John
-- 
The weirdest thing about Window$ is that it's so opaque



On Mon, Mar 25, 2002 at 01:12:38AM +0100, Mipam wrote:
> Hi,
> 
> When im starting snort-1.8.4 im getting these mesages:
> 
> Mar 25 01:02:31  snort: ERROR snort_icmp.conf(103) => Bad Priority
> setting "attempted-recon"
> Mar 25 01:02:31  snort: ERROR snort_icmp.conf(108) => Bad Priority
> setting "bad-unknown"
> Mar 25 01:02:31  snort: ERROR snort_icmp.conf(115) => Bad Priority
> setting "misc-activity"
> 
> I just the icmp.rules default file with entries like these:
> 
> alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP ISS Pinger"; content:"|
> 495353504e475251|";itype:8;depth:32; reference:arachnids,158; classtype:attempte
> d-recon; sid:465; rev:1;)
> 
> Any hints?
> Bye,
> 
> Mipam.




More information about the Snort-users mailing list