[Snort-users] unknown preprocessor "asn1_decode"

SRH-Lists giermo at ...8381...
Thu Apr 17 14:09:07 EDT 2003


> ERROR:  unknown preprocessor "asn1_decode"
> Fatal Error, Quitting..
> [FAILED]
> 
> If I disable that preprocessor, I then get the same prob.
 
The asn1_decode preproc has been removed from 2.0, it was, according to
Andrew Baker, horribly broken.  Look for a replacement in the form of an
SNMP preprocessor coming to a cvs server near you.

> with the "Swedish
> Chef" preproc. "fnord" - 

This was also removed in 2.0.  I think that there is a patch available
somewhere to add it back in.  Dragos?

> If I disable fnord, prob. with xml.

Also removed.  Don't look for it to come back either.  All exotic output
functions will be handled by barnyard, if at all.

> 
> What do I need to do (be nice, now)?

My suggestion is to look at the snort.conf that came with 2.0 and either
use it, or look at it to see what is supported.

I am also gonna go out on a limb and make an assumption that after you
fix all of the snort.conf problems, you will find that your rules are
throwing errors.  Use the 2.0 rules files.


-steve




More information about the Snort-users mailing list