[Snort-users] Unknown ClassType: web-application-attack

Matt M. mr10001 at ...11827...
Sat Aug 30 12:14:13 EDT 2014


Good news, I uncommented those lines and then touched a blacklist and
whitelist file in the necessary directly and now it appears to be running.

I'm seeing commencing packet processing... I think that's a win.  =)


On Sat, Aug 30, 2014 at 10:57 AM, Matt M. <mr10001 at ...11827...> wrote:

> Thanks Y.  I did what you said, then ran into whitelist/blacklist 507
> errors.  So I commented out...
>
> # If you are using reputation preprocessor set these
> #var WHITE_LIST_PATH /etc/snort/rules
> #var BLACK_LIST_PATH /etc/snort/rules
>
> AND
>
> # Reputation preprocessor. For more information see README.reputation
> preprocessor reputation: \
>    memcap 500, \
>    priority whitelist, \
>    nested_ip inner, \
> #   whitelist $WHITE_LIST_PATH/white_list.rules, \
> #   blacklist $BLACK_LIST_PATH/black_list.rules
>
>
> Then I'm back in the same boat with the same error that I had before
> related to the web-application-attack.
>
> Thanks for any ideas on this one,
>
>
> On Sat, Aug 30, 2014 at 2:27 AM, Y M <snort at ...15979...> wrote:
>
>> Date: Fri, 29 Aug 2014 17:29:43 -0500
>> From: mr10001 at ...11827...
>> To: snort-users at lists.sourceforge.net
>> Subject: [Snort-users] Unknown ClassType: web-application-attack
>>
>> Hey Guys,
>>
>> Been pounding the pig all day and still have a few kinks to work out.
>>
>> I've installed snort and pulledpork via brew on OSX.  With this groups
>> help, I was able to get pulledpork functioning.  Now I'm getting the
>> following error when trying to run snort with this command...
>>  sudo snort -c /etc/snort/snort.conf -l /var/log/snort/
>> *ERROR:*
>> Initializing rule chains...
>> ERROR: /etc/snort/rules/app-detect.rules(33) Unknown ClassType:
>> web-application-attack
>>
>> Fatal Error, Quitting..
>>
>>
>> Any ideas on what I'm missing?
>>
>> * Most probably, the web-application-attack is missing from the
>> classification.config file.
>>
>> I did comment out the following (because I was getting a different error
>> around black lists):
>>
>> # Reputation preprocessor. For more information see README.reputation
>> preprocessor reputation: \
>> #   memcap 500, \
>> #   priority whitelist, \
>> #   nested_ip inner, \
>> #   whitelist $WHITE_LIST_PATH/white_list.rules, \
>> #   blacklist $BLACK_LIST_PATH/black_list.rules
>>
>> Thanks for any thoughts,
>>
>> * Download up-to-date configuration files and replace the existing/older
>> ones. You can download them from here:
>> https://www.snort.org/configurations
>>
>> --
>> M., CISSP, GCFE, GCFA
>>
>> *“*To disagree leads to study, to study leads to understanding, to
>> understand is to appreciate, to appreciate is to love. So maybe I’ll end up
>> loving your theory.*”* -*John Wheeler*
>>
>> ------------------------------------------------------------------------------
>> Slashdot TV. Video for Nerds. Stuff that matters. http://tv.slashdot.org/
>> _______________________________________________ Snort-users mailing list
>> Snort-users at lists.sourceforge.net Go to this URL to change user options
>> or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users
>> Snort-users
>> <https://lists.sourceforge.net/lists/listinfo/snort-usersSnort-users>
>> list archive:
>> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>> Please visit http://blog.snort.org to stay current on all the latest
>> Snort news!
>>
>
>
>
> --
> Matt M., CISSP, GCFE, GCFA
>
>
> *“*To disagree leads to study, to study leads to understanding, to
> understand is to appreciate, to appreciate is to love. So maybe I’ll end up
> loving your theory.*”* -*John Wheeler*
>



-- 
Matt M., CISSP, GCFE, GCFA

*“*To disagree leads to study, to study leads to understanding, to
understand is to appreciate, to appreciate is to love. So maybe I’ll end up
loving your theory.*”* -*John Wheeler*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20140830/0cc5ce54/attachment.html>


More information about the Snort-users mailing list