<p dir="ltr">Provide the version of Snort and whether you are using the correct snort.conf with your snort instance?</p>
<p dir="ltr">After that, it becomes an issue of having the right OS configured for the dynamic rules.</p>
<div class="gmail_quote">On Mar 21, 2015 11:00 PM, "Andrew Shagayev" <<a href="mailto:drewshg@...11827...">drewshg@...11827...</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><b><span style="color:rgb(0,0,0)">Hi! <br></span></b></div><b><span style="color:rgb(0,0,0)">running pulledpork:<br></span></b><span style="color:rgb(130,119,0)"><span style="color:rgb(0,0,0)">sudo <a href="http://pulledpork.pl" target="_blank">pulledpork.pl</a> -vv -w -c /usr/local/etc/pulledpork/pulledpork.conf</span></span><b><span style="color:rgb(130,119,0)"><br><br></span></b></div><div><span style="color:rgb(130,119,0)"><font color="#000000"><b>got this:</b><br> ....<br>    Reading rules...<br>Generating Stub Rules....<br>    Generating shared object stubs via:/usr/local/bin/snort -c /usr/local/etc/snort/snort.conf --dump-dynamic-rules=/tmp/tha_rules/so_rules/<br>    An error occurred: WARNING: No dynamic libraries found in directory /usr/local/lib/snort_dynamicrules.<br><span style="background-color:rgb(244,204,204)"><br>    An error occurred: WARNING: ip4 normalizations disabled because not inline.<br><br>    An error occurred: WARNING: tcp normalizations disabled because not inline.<br><br>    An error occurred: WARNING: icmp4 normalizations disabled because not inline.<br><br>    An error occurred: WARNING: ip6 normalizations disabled because not inline.<br><br>    An error occurred: WARNING: icmp6 normalizations disabled because not inline.</span><br><br>...<br><br>Done<br>Please review /var/log/sid_changes.log for additional details<br>Fly Piggy Fly!<br><font><b><br></b></font></font></span></div><div><font><b><span style="color:rgb(130,119,0)"><font color="#000000">When running snort:</font></span><br></b>sudo /usr/local/bin/snort -vde -i en0 -c /usr/local/etc/snort/snort.conf<br><br></font></div><div><font><b>Getting:</b><br>...<br><br>Loading all dynamic detection libs from /usr/local/lib/snort_dynamicrules...<br><span style="background-color:rgb(244,204,204)">WARNING: No dynamic libraries found in directory /usr/local/lib/snort_dynamicrules.</span><br>  Finished Loading all dynamic detection libs from /usr/local/lib/snort_dynamicrules<br>Loading all dynamic preprocessor libs from /usr/local/lib/snort_dynamicpreprocessor/...<br>  Loading dynamic preprocessor library /usr/local/lib/snort_dynamicpreprocessor//libsf_dce2_preproc.so... done<br>  Loading dynamic preprocessor library /usr/local/lib/snort_dynamicpreprocessor//libsf_dnp3_preproc.so... done<br>  Loading dynamic preprocessor library /usr/local/lib/snort_dynamicpreprocessor//libsf_dns_preproc.so... done<br>  Loading dynamic preprocessor library /usr/local/lib/snort_dynamicpreprocessor//libsf_ftptelnet_preproc.so... done<br>  Loading dynamic preprocessor library /usr/local/lib/snort_dynamicpreprocessor//libsf_gtp_preproc.so... done<br>  Loading dynamic preprocessor library /usr/local/lib/snort_dynamicpreprocessor//libsf_imap_preproc.so... done<br>  Loading dynamic preprocessor library /usr/local/lib/snort_dynamicpreprocessor//libsf_modbus_preproc.so... done<br>  Loading dynamic preprocessor library /usr/local/lib/snort_dynamicpreprocessor//libsf_pop_preproc.so... done<br>  Loading dynamic preprocessor library /usr/local/lib/snort_dynamicpreprocessor//libsf_reputation_preproc.so... done<br>  Loading dynamic preprocessor library /usr/local/lib/snort_dynamicpreprocessor//libsf_sdf_preproc.so... done<br>  Loading dynamic preprocessor library /usr/local/lib/snort_dynamicpreprocessor//libsf_sip_preproc.so... done<br>  Loading dynamic preprocessor library /usr/local/lib/snort_dynamicpreprocessor//libsf_smtp_preproc.so... done<br>  Loading dynamic preprocessor library /usr/local/lib/snort_dynamicpreprocessor//libsf_ssh_preproc.so... done<br>  Loading dynamic preprocessor library /usr/local/lib/snort_dynamicpreprocessor//libsf_ssl_preproc.so... done<br>  Finished Loading all dynamic preprocessor libs from /usr/local/lib/snort_dynamicpreprocessor/<br>Log directory = /var/log/snort<br><span style="background-color:rgb(244,204,204)">WARNING: ip4 normalizations disabled because not inline.<br>WARNING: tcp normalizations disabled because not inline.<br>WARNING: icmp4 normalizations disabled because not inline.<br>WARNING: ip6 normalizations disabled because not inline.<br>WARNING: icmp6 normalizations disabled because not inline.</span><br>...<br><b><br></b></font></div><div><b><font>Any ideas what does it mean and how to solve it?<br></font></b></div><div><font><b>Thank you</b><br></font></div><span style="color:rgb(130,119,0)"></span><div><div><div>-- <br><div><div dir="ltr">A.S.<br></div></div>
</div></div></div></div>
<br>------------------------------------------------------------------------------<br>
Dive into the World of Parallel Programming The Go Parallel Website, sponsored<br>
by Intel and developed in partnership with Slashdot Media, is your hub for all<br>
things parallel software development, from weekly thought leadership blogs to<br>
news, videos, case studies, tutorials and more. Take a look and join the<br>
conversation now. <a href="http://goparallel.sourceforge.net/" target="_blank">http://goparallel.sourceforge.net/</a><br>_______________________________________________<br>
Snort-users mailing list<br>
<a href="mailto:Snort-users@lists.sourceforge.net">Snort-users@...4626...ceforge.net</a><br>
Go to this URL to change user options or unsubscribe:<br>
<a href="https://lists.sourceforge.net/lists/listinfo/snort-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-users</a><br>
Snort-users list archive:<br>
<a href="http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users" target="_blank">http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users</a><br>
<br>
Please visit <a href="http://blog.snort.org" target="_blank">http://blog.snort.org</a> to stay current on all the latest Snort news!<br></blockquote></div>