[Snort-users] Snort Configuration Problem

Sujoy Ghosh sujoyghosh297 at ...11827...
Mon Jul 2 10:09:39 EDT 2012


Thanks Joel. It was very helpful. :-)

On Sat, Jun 30, 2012 at 12:38 AM, Joel Esler <jesler at ...1935...> wrote:

> You are using a 2.9.2.0 or greater snort.conf with 2.9.1.2. Either upgrade
> Snort or you'll have to change your snort.conf.
>
> if you search for "snort.conf examples" in Google, the first hit should
> lead you to the VRT recommended configurations.
> --
> Joel Esler
> Senior Research Engineer, VRT
> OpenSource Community Manager
>
> On Jun 29, 2012, at 11:40 AM, Sujoy Ghosh <sujoyghosh297 at ...11827...> wrote:
>
> I am using snort 2.9.1.2 and facing an issue with the configuration. While
> running it, the following is the error:
>
> HttpInspect Config:
> GLOBAL CONFIG
> Max Pipeline Requests: 0
> Inspection Type: STATELESS
> Detect Proxy Usage: NO
> IIS Unicode Map Filename: /etc/snort/unicode.map
> IIS Unicode Map Codepage: 1252
> Memcap used for logging URI and Hostname: 150994944
> Max Gzip Memory: 838860
> Max Gzip Sessions: 6
> Gzip Compress Depth: 65535
> Gzip Decompress Depth: 65535
> ERROR: /etc/snort/snort.conf(328) => Length of the http request method
> shoould not exceed the max request method length of '7'.
> Fatal Error, Quitting..
>
> Please help resolve.
>
> Thanks,
> Sujoy
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
>
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20120702/1a12abdb/attachment.html>


More information about the Snort-users mailing list