[Snort-users] Snort 2.9.0 DCE RPC error [SOLVED] and more

James Lay jlay at ...13475...
Tue Oct 5 10:41:38 EDT 2010


Hey All,

Did an upgrade from 2.8.6.1 to 2.9.0 from source on Slackware 12.1.  Below
is the error I saw:

ERROR: Failed to initialize dynamic preprocessor: SF_DCERPC version 1.1.5
(-1)

After checking /usr/local/lib/snort_dynamicpreprocessor, lo and behold,
old libs.  Nuked those out, but then I got:

ERROR: /usr/local/etc/snort/rules/web-client.rules(357) byte_test option
has bad comparison value: 186a0.

ERROR: /usr/local/etc/snort/rules/web-client.rules(359) byte_test option
has bad comparison value: 186a0.

Which leads me to a question and feature request.  Can snort include
something in the future to detect old libs?  I've seen ntop do this, so I
think it's possible.  And in regards to the rules, what do shmoes like me
do when we upgrade, but aren't using VRT rules?  I'm now running 2.9.0 on
2.8.6.1 rules, and as seen above, that's not always a pretty scene as I've
had to comment out the above rules.  However, as I understand it, I won't
have access to 2.9.0 rules for another month, yes?  What's the best course
of action?  Wait a month to upgrade when the new rulesets mesh with the
new version of snort?  Or plod ahead in hopes that old version rules work
with new version snort?  Is there no way to do a new snort release coupled
with, if not a complete initial new ruleset, at least certain sets
(web-clients.rules) that fix surprises like the above?

Danke, thanks, and all that stuff.

James





More information about the Snort-users mailing list