[Snort-users] snort error

Michael Steele michaels at ...9077...
Thu Jan 12 16:09:57 EST 2017

This has been around for months and should displayed as a warning and not a fatal error.


Kindest regards,



WINSNORT.com Management Team Member


****************** Established ~ 2001 *******************

*          Visit Us @  <http://www.winsnort.com> http://www.winsnort.com           *

*      ~~ FREE WinIDS Snort installation guides ~~      *

*               ~~ FREE support forums ~~               *

* Snort: Open Source Network IDS -  <http://www.snort.org> http://www.snort.org *



From: Ed Borgoyn (eborgoyn) [mailto:eborgoyn at ...589...] 
Sent: Thursday, January 12, 2017 12:52 PM
To: Jim Campbell <jim at ...17675...>; snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] snort error


Does line 326 of snort.conf look like:


decompress_swf { deflate lzma }


If so, then try removing the ‘lzma’ keyword.  If snort is not built with the LZMA libraries for LZMA SWF file decompression, then this keyword will lead to a syntax error.



Ed Borgoyn

Cisco Snort Development Team



From: Jim Campbell <jim at ...17675... <mailto:jim at ...17675...> >
Date: Thursday, January 12, 2017 at 12:20 PM
To: "snort-users at lists.sourceforge.net <mailto:snort-users at ...2652...e.net> " <snort-users at lists.sourceforge.net <mailto:snort-users at ...635...eforge.net> >
Subject: Re: [Snort-users] snort error


It's telling you that line 326 of snort.conf has an error. Perhaps a mismatched or out of place '}'

On 1/12/2017 2:28 AM, Mojtaba Haghighipour wrote:

hi ... it's error when I run snort with command:

snort -c  /etc/snort/rules/etc/snort.conf

ERROR: /etc/snort/rules/etc/snort.conf(326) => Invalid keyword '}' for server configuration.
Fatal Error, Quitting..
Please help me..



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20170112/c8d1023b/attachment.html>

More information about the Snort-users mailing list