[Snort-users] ERROR: Please activate spp_conversation before trying to activate spp_portscan2
neil at ...1633...
Mon Apr 21 09:56:08 EDT 2003
Kit Massengill <KitM at ...8919...> wrote asking:
>Here's what happens when I try to start Snort now:
>ERROR: Please activate spp_conversation before trying to activate
>Fatal Error, Quitting..
I think this means that you have to have a line like this ...
preprocessor conversation: allowed_ip_protocols all, \
timeout 60, max_conversations 3000
... just above this line ...
preprocessor portscan2: scanners_max 256, targets_max 1024, \
target_limit 5, port_limit 20, timeout 60, log \
... in your snort.conf file. Perhaps you deleted it or commented
it out? The backslashes mean that the arguments should be read as
part of one single line of text.
I hope this helps.
Neil Dickey, Ph.D.
Northern Illinois University
More information about the Snort-users