[Snort-users] New Version
jh at ...1935...
Thu Dec 18 12:54:01 EST 2003
On Thu, Dec 18, Timm Schneider wrote:
> I installed the new version.
> After that is start snort and then there will be an error messages
> that says /etc/snort/snort.conf (291) invalid File name for IIS unicade Map
> What is wrong?
In the default snort.conf:
282 # unicode.map should be wherever your snort.conf lives, or given
283 # a full path to where snort can find it.
You need to move unicode.map into your snort conf dir, or give a full
path name. unicode.map is in the <snort src>/etc directory. What
you're looking for is the line that reads like:
284 preprocessor http_inspect: global \
285 iis_unicode_map unicode.map 1252
You should also take a look at the snort user manual for HttpInspect
before really digging into it (if you haven't already).
More information about the Snort-users