[Snort-users] shellcode error

Hugo Ferr snortgrp at ...125...
Thu May 30 13:54:04 EDT 2002


I would like to have some understanding regarding the following:
1. Why should I define ports for shellcode rules?
2. What is the exact syntax? (var $SHELLCODE_PORTS)

P.S> I 'm big fan snort of snort, but I really feel like documentaion should
be improved. (Or is it a topic for mail list dedicated for rants :-) ?)
----- Original Message -----
From: <bthaler at ...2720...>
To: <snort-users at lists.sourceforge.net>
Sent: Thursday, May 30, 2002 4:37 PM
Subject: RE: [Snort-users] shellcode error


> Umm.....
>
> I think you answered your own question:
>
> Snort says:
> "Probably your variable SHELLCODE_PORTS is not defined..."
>
> And you say:
> "I don't have this variable in snort.conf"
>
> IANAE (expert), but I think if you define $SHELLCODE_PORTS in snort.conf,
> the error will go away.
>
>
>
>
>
>
>
> Sincerely,
>
> Brad T.
>
>
>
>
>
>
> > -----Original Message-----
> > From: snort-users-admin at lists.sourceforge.net
> > [mailto:snort-users-admin at lists.sourceforge.net]On Behalf Of Hugo Ferr
> > Sent: Thursday, May 30, 2002 4:26 PM
> > To: snort-users at lists.sourceforge.net
> > Subject: [Snort-users] shellcode error
> >
> >
> > Downloaded latest stable rules for Snort 1.8.6, when I stort
> > snort I get the
> > following;
> >
> > [!] ERROR ./snortrules/shellcode.rules(14) => Bad port number:
> > "(msg:"SHELLCODE"
> > Fatal Error, Quitting..
> >
> > The only thing I've found on the web suggests:
> > "Probably your variable SHELLCODE_PORTS is not defined or misconfigured
in
> > snort.conf file."
> > I don't have this variable in snort.conf
> > (When I disable shellcode rules snort starts fine, but....what
> > the hell..it
> > should work with those rules as well :-)
> >
> >
> >
> >
> >
> >
> >
> >
> > _______________________________________________________________
> >
> > Don't miss the 2002 Sprint PCS Application Developer's Conference
> > August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm
> >
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> >
>
>
> _______________________________________________________________
>
> Don't miss the 2002 Sprint PCS Application Developer's Conference
> August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm
>
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>




More information about the Snort-users mailing list