[Snort-users] 3.0 beta2 does not load dynamic preprocessors

Nerijus Krukauskas nkrukauskas at ...11827...
Thu Sep 4 08:41:52 EDT 2008


  Wanted to try the 3.0b2 release of snort, but stumbled on one
problem. It refuses to load dynamic preprocessors. The config for
3.0b2 is converted from config used for 2.8.2.2. Everything is done
according to README.bridge file. The path specified in resulting
snort.lua is correct and contains a bunch of preprocessors. But
snortsp spits error messages like:

snort.conf(628) unknown dynamic preprocessor "smtp"
snort.conf(747) unknown dynamic preprocessor "ssh"
etc.

  Tried strace'ing the snortsp process. There're NO attempts to load
anything from preproc dir. Not even the
/usr/local/lib/snort/sf_engine.so, which is also specified in
snort.lua.
  I use the following example script from README.bridge to test the config:
--
snort="/usr/local/snortsp/lib/snort/snort.so"
opttab={ conf="snort.conf" }
analyzer.cfgtest({module=snort, data=opttab, order=1})
ssp.shutdown()
--


  Don't know where to look further... Anyone else tried 3.0b2?

-- 
http://nk99.org/




More information about the Snort-users mailing list