[Snort-users] Error running snort

waldo kitty wkitty42 at ...14940...
Wed Oct 10 21:02:51 EDT 2012

On 10/10/2012 17:58, AllowOverride wrote:
> this leads to another issue, so_rules, i did not see ubuntu 12.04
> listed, only up to 12.04. is there a updated precompiled rule set for
> 12.04 coming soon, not that i know what they are for, i figure packets
> being analyzed should matter what distro it is coming for?

SO rules are SharedObject rules... in other words, they are like DLL files... 
but, unlike the regular textual rules, these are source code and can perform 
code oriented feats that the plain text rules cannot... "feats" like those you 
would see in a program... certain math functions and comparison options that are 
just not capable of being done by text rules...

as such, they must be compiled against the kernel running on your *nix *sd etc 

> i assume the precompiled rules are for base services included in each
> linux different distro, thus the need to specify them in the first
> place.
> dont answer that, i will figure it out, just thinking out loud..

:) :)

> On Wed, 2012-10-10 at 14:27 -0600, Jefferson, Shawn wrote:
>> You have the wrong version of so rules for your distro/os.
>> ----- Original Message -----
>> From: Akinwale Fasuru<fashman2k1 at ...131...>
>> To: snort-users at lists.sourceforge.net<snort-users at lists.sourceforge.net>
>> Sent: Wed Oct 10 12:47:43 2012
>> Subject: [Snort-users] Error running snort
>> Pls i encountered this erro when tring to run snort # snort -c /etc/snort/snort.conf
>> ERROR: Failed to load /usr/local/lib/snort_dynamicrules/netbios.so: /usr/local/lib/snort_dynamicrules/netbios.so: wrong ELF class: ELFCLASS32
>> What can i do?
>> Wale

More information about the Snort-users mailing list