[Snort-users] Error: /etc/snort/snort.conf(291) => invalid stream tcp policy option

Joel Esler (jesler) jesler at ...589...
Thu Feb 18 10:26:51 EST 2016


What does line 291 say in the snort.conf?

--
Joel Esler
Manager, Talos Group




On Feb 18, 2016, at 6:02 AM, priyank shah <priyankshah902002 at ...11827...<mailto:priyankshah902002 at ...11827...>> wrote:

Hey Al,

I removed -i eth0. And since I'm using Ubuntu 15.10 my interfaces are named enp0s8 ans so on, but I tried removing it as well, still same error,

Error: /etc/snort/snort.conf(291) => Invalid Stream TCP policy option


On Thu, Feb 18, 2016 at 5:50 AM, Al Lewis (allewi) <allewi at ...589...<mailto:allewi at ...589...>> wrote:
Remove the -I eth0 to check the configuration.

Also.. its telling you that your problem is something on line 291 of your config file.

Error: /etc/snort/snort.conf(291)


Albert Lewis
QA Software Engineer
SOURCEfire, Inc. now part of Cisco
9780 Patuxent Woods Drive
Columbia, MD 21046
Phone: (office) 443.430.7112<tel:443.430.7112>
Email: allewi at ...589...<mailto:allewi at ...589...>

From: priyank shah [mailto:priyankshah902002 at ...11827...<mailto:priyankshah902002 at ...11827...>]
Sent: Thursday, February 18, 2016 5:44 AM
To: snort-users at lists.sourceforge.net<mailto:snort-users at ...3783...net>
Subject: [Snort-users] Error: /etc/snort/snort.conf(291) => invalid stream tcp policy option

Hello Snort-users,

I tried installing snort-2.9.8.0 on ubuntu 15.10 that I am running on Oracle VirtualBox. After the installation I tried running

sudo snort -T -i eth0 -c /etc/snort/snort.conf

to check the configuration.
But I got an error saying

Error: /etc/snort/snort.conf(291) => Invalid Stream TCP policy option
Fatal Error, Quitting..

Can anyone please help.

Thanks,
Pri

------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=272487151&iu=/4140_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20160218/91a93f74/attachment.html>


More information about the Snort-users mailing list