[Snort-users] Error running snort

AllowOverride allowoverride at ...11827...
Thu Oct 11 15:32:20 EDT 2012


thanks waldo, you are community :)

On Wed, 2012-10-10 at 21:02 -0400, waldo kitty wrote:
> On 10/10/2012 17:58, AllowOverride wrote:
> > this leads to another issue, so_rules, i did not see ubuntu 12.04
> > listed, only up to 12.04. is there a updated precompiled rule set for
> > 12.04 coming soon, not that i know what they are for, i figure packets
> > being analyzed should matter what distro it is coming for?
> 
> SO rules are SharedObject rules... in other words, they are like DLL files... 
> but, unlike the regular textual rules, these are source code and can perform 
> code oriented feats that the plain text rules cannot... "feats" like those you 
> would see in a program... certain math functions and comparison options that are 
> just not capable of being done by text rules...
> 
> as such, they must be compiled against the kernel running on your *nix *sd etc 
> system...
> 
> > i assume the precompiled rules are for base services included in each
> > linux different distro, thus the need to specify them in the first
> > place.
> >
> > dont answer that, i will figure it out, just thinking out loud..
> 
> :) :)
> 
> >
> >
> > On Wed, 2012-10-10 at 14:27 -0600, Jefferson, Shawn wrote:
> >> You have the wrong version of so rules for your distro/os.
> >>
> >>
> >>
> >> ----- Original Message -----
> >> From: Akinwale Fasuru<fashman2k1 at ...131...>
> >> To: snort-users at lists.sourceforge.net<snort-users at lists.sourceforge.net>
> >> Sent: Wed Oct 10 12:47:43 2012
> >> Subject: [Snort-users] Error running snort
> >>
> >> Pls i encountered this erro when tring to run snort # snort -c /etc/snort/snort.conf
> >>
> >> ERROR: Failed to load /usr/local/lib/snort_dynamicrules/netbios.so: /usr/local/lib/snort_dynamicrules/netbios.so: wrong ELF class: ELFCLASS32
> >>
> >> What can i do?
> >>
> >> Wale
> 
> ------------------------------------------------------------------------------
> Don't let slow site performance ruin your business. Deploy New Relic APM
> Deploy New Relic app performance management and know exactly
> what is happening inside your Ruby, Python, PHP, Java, and .NET app
> Try New Relic at no cost today and get our sweet Data Nerd shirt too!
> http://p.sf.net/sfu/newrelic-dev2dev
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 
> Please visit http://blog.snort.org to stay current on all the latest Snort news!





More information about the Snort-users mailing list