[Snort-users] Unknown ClassType: web-application-attack

Y M snort at ...15979...
Sat Aug 30 03:27:20 EDT 2014


Date: Fri, 29 Aug 2014 17:29:43 -0500
From: mr10001 at ...11827...
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Unknown ClassType: web-application-attack

Hey Guys,
Been pounding the pig all day and still have a few kinks to work out.
I've installed snort and pulledpork via brew on OSX.  With this groups help, I was able to get pulledpork functioning.  Now I'm getting the following error when trying to run snort with this command...








sudo snort -c /etc/snort/snort.conf -l /var/log/snort/
ERROR:
Initializing rule chains...
ERROR: /etc/snort/rules/app-detect.rules(33) Unknown ClassType: web-application-attack












Fatal Error, Quitting..


Any ideas on what I'm missing?
* Most probably, the web-application-attack is missing from the classification.config file.
I did comment out the following (because I was getting a different error around black lists):

# Reputation preprocessor. For more information see README.reputationpreprocessor reputation: \#   memcap 500, \#   priority whitelist, \#   nested_ip inner, \
#   whitelist $WHITE_LIST_PATH/white_list.rules, \#   blacklist $BLACK_LIST_PATH/black_list.rules 
Thanks for any thoughts,
* Download up-to-date configuration files and replace the existing/older ones. You can download them from here: https://www.snort.org/configurations
-- 
M., CISSP, GCFE, GCFA


“To disagree leads to study, to study leads to understanding, to understand is to appreciate, to appreciate is to love. So maybe I’ll end up loving your theory.” -John Wheeler




------------------------------------------------------------------------------
Slashdot TV.  
Video for Nerds.  Stuff that matters.
http://tv.slashdot.org/
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news! 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20140830/d5cdcbb7/attachment.html>


More information about the Snort-users mailing list