[Snort-users] Unknown SMTP configuration option 260

Nigel Houghton nhoughton at ...1935...
Wed Aug 24 16:43:32 EDT 2011


On Aug 24, 2011, at 4:17 PM, Johnny Venter wrote:

> I am receiving the following "fatal" error message:
> 
> Unknown SMTP configuration option 260
> 
> From the smtp.conf file, this option appears here "{ EXPN VRFY RCPT } max_command_line_len  max_header_line_len  max_response_line_len  alt_max_command_line_len 260"
> 
> This causes my NIC to be disabled and thus not capture any packets.  If I comment out the entries in the smtp.conf file, snort starts up successfully and it can capture packets as normal.
> 
> The only issue is that the smtp preprocessor does not get loaded.

That configuration line is completely wrong. Where do you get the smtp.conf file? The options are in the snort.conf files shipped with Snort and with the rule packs.

It should look something like this:

preprocessor smtp: ports { 25 etc.....
 ....other config options.....
 max_command_line_len 512 \
 max_header_line_len 1000 \
 max_response_line_len 512 \
 alt_max_command_line_len 260 { EXPN VRFY RCPT } \
 valid_cmds .....etc....

--
Nigel Houghton
Head Mentalist
SF VRT Department of Intelligence Excellence
http://vrt-blog.snort.org/ && http://labs.snort.org/





More information about the Snort-users mailing list