[Snort-users] ERROR: Please activate spp_conversation before trying to activate spp_portscan2

Neil Dickey neil at ...1633...
Mon Apr 21 09:56:08 EDT 2003


Kit Massengill <KitM at ...8919...> wrote asking:

>Here's what happens when I try to start Snort now:
>
>...snip...
>
>ERROR: Please activate spp_conversation before trying to activate
>spp_portscan2
>Fatal Error, Quitting..
>[FAILED]

I think this means that you have to have a line like this ...

  preprocessor conversation: allowed_ip_protocols all, \
     timeout 60, max_conversations 3000

... just above this line ...

  preprocessor portscan2: scanners_max 256, targets_max 1024, \
     target_limit 5, port_limit 20, timeout 60, log \
     /var/snort/snort_portscan.log

... in your snort.conf file.  Perhaps you deleted it or commented
it out?  The backslashes mean that the arguments should be read as
part of one single line of text.

I hope this helps.

Best regards,

Neil Dickey, Ph.D.
Research Associate/Sysop
Geology Department
Northern Illinois University
DeKalb, Illinois
60115




More information about the Snort-users mailing list