[Snort-users] Config issues

Edward Borgoyn e.c.borgoyn at ieee.org
Mon Aug 14 07:36:46 EDT 2017


Hi,
  The default Windows Snort build does NOT have LZMA decompression support
included in the build.

  However, the default snort.conf includes the line:

     decompress_swf { deflate lzma }

  The problem is that the lzma decompression option is not available in
snort and the 'lzma' keyword option is also not available.  Sorry for the
obscure error message under these conditions.  When LZMA is not included
the build, the 'lzma' keyword is simply not valid.

  I hope this helps.

    Ed


On Sat, Aug 12, 2017 at 10:53 AM, Marcin Dulak via Snort-users <
snort-users at lists.snort.org> wrote:

> Hi,
>
> please always try to use google first to search for answers:
> https://www.google.com/search?q=%22c:%5Csnort%5Cetc%5Csnort.
> conf(329)+%3D%3E+Invalid+keyword+%27%7D%27+for+server+
> configuration.%22&oq=%22c:%5Csnort%5Cetc%5Csnort.conf(
> 329)+%3D%3E+Invalid+keyword+%27%7D%27+for+server+configuration.%22
> There are several discussions pointing to lzma problem.
> Hopefully you find the definitive solution, then post a summary on this
> forum.
> Otherwise I'm sure someone else will come with more answers.
>
> Marcin
>
> On Sat, Aug 12, 2017 at 4:38 PM, Sumit Balodi via Snort-users <
> snort-users at lists.snort.org> wrote:
>
>> Can't Solve this problem .
>>
>> ttpInspect Config:
>>     GLOBAL CONFIG
>>       Detect Proxy Usage:       NO
>>       IIS Unicode Map Filename: c:\snort\etc\unicode.map
>>       IIS Unicode Map Codepage: 1252
>>       Memcap used for logging URI and Hostname: 150994944
>>       Max Gzip Memory: 838860
>>       Max Gzip Sessions: 2688
>>       Gzip Compress Depth: 65535
>>       Gzip Decompress Depth: 65535
>> ERROR: c:\snort\etc\snort.conf(329) => Invalid keyword '}' for server
>> configuration.
>>
>> Looking forward for your reply.
>>
>> _______________________________________________
>> Snort-users mailing list
>> Snort-users at lists.snort.org
>> Go to this URL to change user options or unsubscribe:
>> https://lists.snort.org/mailman/listinfo/snort-users
>>
>> Please visit http://blog.snort.org to stay current on all the latest
>> Snort news!
>>
>>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.snort.org
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20170814/ae410bde/attachment.html>


More information about the Snort-users mailing list