[Snort-users] snort and snortsam

Frank Knobbe frank at ...9761...
Mon Apr 19 15:49:01 EDT 2004


On Mon, 2004-04-19 at 16:31, snort teste wrote:
> i upgraded my snort's version to 2.1.2, and recompiled the snort to support 
> the snortsam.
> when i reinitialize the snortsam the bellow message is showed:
> 
> 2004/04/19, 17:32:49, -, 1, snortsam, Starting to listen for Snort alerts.
> 2004/04/19, 17:37:13, 10.12.0.15, 1, snortsam, Snort station 10.12.0.15 
> using wrong password, trying to re-sync.


Looks like you restarted Snortsam but not Snort. In that case, on the
first block request, Snort will use the previously negotiated password,
not the initial one Snortsam is expecting. On that block, both Snort and
Snortsam will renegotiate encryption keys and continue with their
business.

So this is not an error per se. It's merely a note. If you do not
restart either one of them, and then you see errors like this, it may be
because you have a second instance of Snort started, or someone is
trying to insert himself between Snort and Snortsam. 

If you kill Snort without shutting it down gracefully, you will get this
warning once as well.

Hope this helps,
Frank

PS: You might want to post Snortsam related issues to the
discussion at ...10203... mail lists, and not bore the Snort users here :)

-- 
Warning at the Gates of Bill:  
Abandon hope, all ye who press <ENTER> here...

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20040419/ce92d7ed/attachment.sig>


More information about the Snort-users mailing list