[Snort-users] ERROR: Preprocessor already registered with ID 21

Russ Combs rcombs at ...1935...
Mon Aug 30 10:31:47 EDT 2010


On Fri, Aug 27, 2010 at 9:54 PM, waldo kitty <wkitty42 at ...14940...>wrote:

> On 8/26/2010 19:07, Russ Combs wrote:
> >
> >
> > On Thu, Aug 26, 2010 at 6:44 PM, Richard Martin <
> richard.martin1980 at ...11827...
> > <mailto:richard.martin1980 at ...11827...>> wrote:
> >
> >     ERROR: Preprocessor already registered with ID 21
> >     Fatal Error, Quitting..
> >
> >     Any ideas?
> >
> > Looks like you've got two or more of preprocessor X lines in your conf
> (ie the
> > same one repeated).  Not sure which though.
>
> shouldn't snort tell which preprocessor it is? ;)
>

Yeah - you would think - but the Snort code doesn't facilitate that.
Looking into why that isn't provided I realized my earlier thought wasn't
correct:

* If you have two preprocessor X lines you will get a preprocessor specific
error message.

* If the RegisterPreprocessor function is called more than once for a given
preprocessor, you get "Duplicate preprocessor keyword: <name>".

* If the registered init function installs a preprocessor function twice, or
two different preprocessors try to install an API function with the same
preprocessor ID, you will get "Preprocessor already registered with ID
<id>".

My guess is that in this case a new preprocessor was created that uses the
same ID as another.



>
>
> ------------------------------------------------------------------------------
> Sell apps to millions through the Intel(R) Atom(Tm) Developer Program
> Be part of this innovative community and reach millions of netbook users
> worldwide. Take advantage of special opportunities to increase revenue and
> speed time-to-market. Join now, and jumpstart your future.
> http://p.sf.net/sfu/intel-atom-d2d
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20100830/c1cbcb5e/attachment.html>


More information about the Snort-users mailing list