[Snort-users] New Version

Jeremy Hewlett jh at ...1935...
Thu Dec 18 12:54:01 EST 2003

On Thu, Dec 18, Timm Schneider wrote:
> I installed the new version.
> After that is start snort and then there will be an error messages
> that says /etc/snort/snort.conf (291) invalid File name for IIS unicade Map  
> file.
> What is wrong?

In the default snort.conf:

282 # unicode.map should be wherever your snort.conf lives, or given
283 # a full path to where snort can find it.

You need to move unicode.map into your snort conf dir, or give a full
path name. unicode.map is in the <snort src>/etc directory. What
you're looking for is the line that reads like:

284 preprocessor http_inspect: global \
285     iis_unicode_map unicode.map 1252

You should also take a look at the snort user manual for HttpInspect
before really digging into it (if you haven't already).

More information about the Snort-users mailing list