[Snort-users] http_inspect_server syntax error ?

Y M snort at ...15979...
Sun Mar 1 13:34:00 EST 2015


I think you still need to specify a "default" http_inspect policy (correct me if I am wrong), although I could not find a reference to support that in the documentation (again, correct me if I am wrong). For example, the below works:
preprocessor http_inspect_server: server default profile apache ports { 80 }preprocessor http_inspect_server: server 1.2.3.4 profile apache ports { 80 }
> From: research at ...17107...> Date: Sun, 1 Mar 2015 12:25:03 -0500
> To: snort-users at lists.sourceforge.net
> Subject: [Snort-users] http_inspect_server syntax error ?
> 
> Hi,
> 
> I am currently trying to configure the: http_inspect_server preprocessor options.
> 
> As a minimalist approach, I have:
> 
> 	preprocessor http_inspect_server: server 1.2.3.4 profile apache ports { 80 }
> 
> I am aiming to have the options:
> 
> 	server 1.2.3.4		My web server IP address
> 	profile apache		My web server is Apache
> 	ports { 80 } 		…running HTTP on port 80
> 
> However, when I attempt to launch Snort, I receive the following error:
> 
> 	Verifying Preprocessor Configurations!
> 	HttpInspectConfigCheck() default server configuration not specified
> 	Fatal Error, Quitting..
> 
> …which seems to apply it wants a profile of default.
> 
> What am I doing wrong ?
> 
> Thanks
> ------------------------------------------------------------------------------
> Dive into the World of Parallel Programming The Go Parallel Website, sponsored
> by Intel and developed in partnership with Slashdot Media, is your hub for all
> things parallel software development, from weekly thought leadership blogs to
> news, videos, case studies, tutorials and more. Take a look and join the 
> conversation now. http://goparallel.sourceforge.net/
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> 
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150301/46089f41/attachment.html>


More information about the Snort-users mailing list