<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body><div>You are using a 2.9.2.0 or greater snort.conf with 2.9.1.2. Either upgrade Snort or you'll have to change your snort.conf. </div><div><br></div><div>if you search for "snort.conf examples" in Google, the first hit should lead you to the VRT recommended configurations.  <br>--<div>Joel Esler</div><div>Senior Research Engineer, VRT</div><div>OpenSource Community Manager</div></div><div><br>On Jun 29, 2012, at 11:40 AM, Sujoy Ghosh <<a href="mailto:sujoyghosh297@...11827...">sujoyghosh297@...11827...</a>> wrote:<br><br></div><blockquote type="cite"><div><div><span style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">I am using snort 2.9.1.2 and facing an issue with the configuration. While running it, the following is the error:</span><br style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">
<br style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)"><span style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">HttpInspect Config:</span><br style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">
<span style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">GLOBAL CONFIG</span><br style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">
<span style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">Max Pipeline Requests: 0</span><br style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">
<span style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">Inspection Type: STATELESS</span><br style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">
<span style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">Detect Proxy Usage: NO</span><br style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">
<span style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">IIS Unicode Map Filename: /etc/snort/unicode.map</span><br style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">
<span style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">IIS Unicode Map Codepage: 1252</span><br style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">
<span style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">Memcap used for logging URI and Hostname: 150994944</span><br style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">
<span style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">Max Gzip Memory: 838860</span><br style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">
<span style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">Max Gzip Sessions: 6</span><br style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">
<span style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">Gzip Compress Depth: 65535</span><br style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">
<span style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">Gzip Decompress Depth: 65535</span><br style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">
<span style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">ERROR: /etc/snort/snort.conf(328) => Length of the http request method shoould not exceed the max request method length of '7'.</span><br style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">
<span style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">Fatal Error, Quitting..</span><br style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">
<br style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)"><span style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">Please help resolve.</span>
</div><div><span style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)"><br></span></div><div><span style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">Thanks,</span></div>
<div><span style="color:rgb(51,51,51);font-family:arial,helvetica,clean,sans-serif;font-size:13px;line-height:16px;background-color:rgb(255,255,255)">Sujoy</span></div>
</div></blockquote><blockquote type="cite"><div><span>------------------------------------------------------------------------------</span><br><span>Live Security Virtual Conference</span><br><span>Exclusive live event will cover all the ways today's security and </span><br><span>threat landscape has changed and how IT managers can respond. Discussions </span><br><span>will include endpoint security, mobile security and the latest in malware </span><br><span>threats. <a href="http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/">http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/</a></span></div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Snort-users mailing list</span><br><span><a href="mailto:Snort-users@lists.sourceforge.net">Snort-users@lists.sourceforge.net</a></span><br><span>Go to this URL to change user options or unsubscribe:</span><br><span><a href="https://lists.sourceforge.net/lists/listinfo/snort-users">https://lists.sourceforge.net/lists/listinfo/snort-users</a></span><br><span>Snort-users list archive:</span><br><span><a href="http://www.geocrawler.com/redir-sf.php3?list=snort-users">http://www.geocrawler.com/redir-sf.php3?list=snort-users</a></span><br><span></span><br><span>Please visit <a href="http://blog.snort.org">http://blog.snort.org</a> to stay current on all the latest Snort news!</span></div></blockquote></body></html>