[Snort-users] preprocessor file_inspect does not capture file

Y M snort at ...15979...
Wed Dec 2 02:16:30 EST 2015

I haven't played enough with the file_inspect preprocessor but what is the size of the file in relation to things like "file_capture_min", "file_capture_max"?

Also, does the path in "capture_disk" exist?

Finally, as far as I understand, only those files that have their hashes in the black or grey lists will be captured. Please anyone, correct me if I am wrong.


Sent from Mobile

From: Lương Minh Tuấn <not.soledad at ...11827...<mailto:not.soledad at ...11827...>>
Sent: Wednesday, December 2, 2015 9:46 AM
Subject: [Snort-users] preprocessor file_inspect does not capture file
To: <snort-users at lists.sourceforge.net<mailto:snort-users at lists.sourceforge.net>>

Hi everybody,
I had problem when using file_inspect to capture file send over
FTP. Please help me resolv. Here's my Snort info:
- Server OS:
$cat /etc/redhat-release
CentOS Linux release 7.1.1503 (Core)
- Snort version:, build options: --enable-file-inspect
--enable-open-appid --enable-sourcefire
- configuration file:
exactly from snortrules-snapshot-2976.tar.gz, add file_inspect
config as discuss in README.file:
include file_magic.conf
preprocessor file_inspect: signature, \
capture_queue_size 5000, \
capture_disk /home/file_capture/tmp/

Snort does not detect or process any file, here's my exit stat:
File Preprocessor Statistics
Total file type callbacks: 0
Total file signature callbacks: 0
Total files would saved to disk: 0
Total files saved to disk: 0
Total file data saved to disk: 0 bytes
Total files duplicated: 0
Total files reserving failed: 0
Total file capture min: 0
Total file capture max: 0
Total file capture memcap: 0
Total files reading failed: 0
Total file agent memcap failures: 0
Total files sent: 0
Total file data sent: 0
Total file transfer failures: 0
Files processed: none

I tried to build snort v2.9.7.0, and latest but no
luck. Please help me!

Thanks and best regards!
Lương Minh Tuấn
Email: not.soledad at ...11827...<mailto:not.soledad at ...11827...>
Skype: minhtuan208

Go from Idea to Many App Stores Faster with Intel(R) XDK
Give your users amazing mobile app experiences with Intel(R) XDK.
Use one codebase in this all-in-one HTML5 development environment.
Design, debug & build mobile apps & 2D/3D high-impact games for multiple OSs.
Snort-users mailing list
Snort-users at lists.sourceforge.net<mailto:Snort-users at lists.sourceforge.net>
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

Please visit http://blog.snort.org to stay current on all the latest Snort news!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20151202/507d644e/attachment.html>

More information about the Snort-users mailing list