[Snort-users] UNKNOWN METHOD

waldo kitty wkitty42 at ...14940...
Thu Nov 7 13:34:59 EST 2013


On 11/7/2013 12:44 PM, Jorge G. Perez wrote:
> preprocessor http_inspect_server: server default \
>
>       http_methods { GET POST PUT SEARCH MKCOL COPY MOVE LOCK \
>                      UNLOCK NOTIFY POLL BCOPY BDELETE BMOVE LINK \
>                      UNLINK OPTIONS HEAD DELETE TRACE TRACK CONNECT \
>                      SOURCE SUBSCRIBE UNSUBSCRIBE PROPFIND PROPPATCH \
>                      BPROPFIND BPROPPATCH RPC_CONNECT PROXY_SUCCESS \
>                      BITS_POST CCM_POST SMS_POST RPC_IN_DATA RPC_OUT_DATA
> RPC_ECHO_DATA } \

does your config really look like this with RPC_ECHO_DATA on a line by itself or 
is this an effect of wordwrapping in your post? if your config really does have 
RPC_ECHO_DATA on a line by itself, then the line above needs a trailing "\" 
added after RPC_OUT_DATA...

-- 
NOTE: No off-list assistance is given without prior approval.
       Please keep mailing list traffic on the list unless
       private contact is specifically requested and granted.




More information about the Snort-users mailing list