RE: [Snort-users] Snort Installation on Win2K problems

permalink · #1 (**permalink**) 06-02-2004

This is a multi-part message in MIME format.

------=_NextPart_000_0009_01C44892.80915610
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit

IDSCenter has not been updated in almost a year. This will most likely break
if you are using newer versions of Snort.

Kindest regards,
Michael...

WINSNORT.com Management Team Member
--
Pick up your FREE Windows or UNIX Snort installation guides
mailto:support@winsnort.com
Website: http://www.winsnort.com
Snort: Open Source Network IDS - http://www.snort.org

_____

From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of geomax
Sent: Wednesday, June 02, 2004 8:57 AM
To: snort-users@lists.sourceforge.net
Subject: [Snort-users] Snort Installation on Win2K problems

Hello,

We're new to Snort and are trying to implement Snort as part of our IDS at
our company.

We want to install Snort on a Win2K box, using IDSCenter RC4 as the front
end. However, after install, any configuration change made via IDSCenter
causes the Snort service to fails to start.

The Win2K box is 2000 Professional, SP4. Snort is version 2_1_2, installed
WinPcap 2.3

The error message displayed is:

Error: D:\Snort\etc\snort.conf(246) => Invalid keyword 'preprocessor' for
'global' configuration. Fatal error, Quitting...

I read the FAQ, and section 5.5 (How to start Snort as a Win32 service)
states that paths need to be set up from from the command line. Can similar
parameters be added to the Snorter service as well?

When the service fails, in IDSCenter, in the Overview console, you can view
the message that the service has failed to start, and this Snort command
line is displayed:

C:\SNORT\bin\snort.exe -c "C:\SNORT\etc\snort.conf" -l "C:\SNORT\log"

....but can't be modified. How do I? Is this string correct?

Does anyone have any suggestions about what is causing this error??

Thanks!

George

------=_NextPart_000_0009_01C44892.80915610
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html>

<head>
<meta http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 11 (filtered)">
<style>

</style>

</head>

<body lang=3DEN-US link=3Dblue vlink=3Dpurple>

<div class=3DSection1>

<p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span =
style=3D'font-size:
10.0pt;font-family:Arial;color:navy'>IDSCenter has not been updated in =
almost a
year. This will most likely break if you are using newer versions of =
Snort.</span></font></p>

<div>

<p style=3D'margin-bottom:12.0pt'><font size=3D2 color=3Dnavy =
face=3D"Times New Roman"><span
style=3D'font-size:10.0pt;color:navy'>Kindest regards,<br>
Michael...<br>
<br>
WINSNORT.com Management Team Member<br>
--<br>
Pick up your FREE Windows or UNIX Snort installation
guides      <br>
<a =
href=3D"mailto:support@winsnort.com">mailto:suppor t@winsnort.com</a><br>
Website: <a =
href=3D"http://www.winsnort.com">http://www.winsnort.com</a><br>
Snort: Open Source Network IDS - <a =
href=3D"http://www.snort.org">http://www.snort.org</a><br>
<br>
</span></font></p>

</div>

<div style=3D'border:none;border-left:solid blue 1.5pt;padding:0in 0in =
0in 4.0pt'>

<div>

<div class=3DMsoNormal align=3Dcenter style=3D'text-align:center'><font =
size=3D3
face=3D"Times New Roman"><span style=3D'font-size:12.0pt'>

<hr size=3D2 width=3D"100%" align=3Dcenter tabindex=3D-1>

</span></font></div>

<p class=3DMsoNormal><b><font size=3D2 face=3DTahoma><span =
style=3D'font-size:10.0pt;
font-family:Tahoma;font-weight:bold'>From:</span></font></b><font =
size=3D2
face=3DTahoma><span style=3D'font-size:10.0pt;font-family:Tahoma'>
snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] <b><span =
style=3D'font-weight:
bold'>On Behalf Of </span></b>geomax<br>
<b><span style=3D'font-weight:bold'>Sent:</span></b> Wednesday, June 02, =
2004
8:57 AM<br>
<b><span style=3D'font-weight:bold'>To:</span></b>
snort-users@lists.sourceforge.net<br>
<b><span style=3D'font-weight:bold'>Subject:</span></b> [Snort-users] =
Snort
Installation on Win2K problems</span></font></p>

</div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'> </span></font></p>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'>Hello,</span></font></p>

</div>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'> </span></font></p>

</div>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'>We're new to Snort and are trying to implement Snort as part of =
our IDS
at our company. </span></font></p>

</div>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'> </span></font></p>

</div>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'>We want to install Snort on a Win2K box, using IDSCenter RC4 as =
the
front end. However, after install, any configuration change made via =
IDSCenter
causes the Snort service to fails to start.</span></font></p>

</div>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'> </span></font></p>

</div>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'>The Win2K box is 2000 Professional, SP4. Snort is version 2_1_2,
installed WinPcap 2.3</span></font></p>

</div>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'> </span></font></p>

</div>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'>The error message displayed is:</span></font></p>

</div>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'> </span></font></p>

</div>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'>Error: D:\Snort\etc\snort.conf(246) =3D> Invalid keyword
'preprocessor' for 'global' configuration. Fatal error, =
Quitting...</span></font></p>

</div>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'> </span></font></p>

</div>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'>I read the FAQ, and section 5.5 (How to start Snort as a Win32 =
service)
states that paths need to be set up from from the command line. Can =
similar
parameters be added to the Snorter service as well?</span></font></p>

</div>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'> </span></font></p>

</div>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'>When the service fails, in IDSCenter, in the Overview console, =
you can
view the message that the service has failed to start, and this Snort =
command
line is displayed:</span></font></p>

</div>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'> </span></font></p>

</div>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'>C:\SNORT\bin\snort.exe -c "C:\SNORT\etc\snort.conf" -l
"C:\SNORT\log"</span></font></p>

</div>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'> </span></font></p>

</div>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'>...but can't be modified. How do I? Is this string =
correct?</span></font></p>

</div>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'> </span></font></p>

</div>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'>Does anyone have any suggestions about what is causing this =
error??</span></font></p>

</div>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'> </span></font></p>

</div>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'>Thanks!</span></font></p>

</div>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'> </span></font></p>

</div>

<div>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'>George</span></font></p>

</div>

</div>

</div>

</body>

</html>

------=_NextPart_000_0009_01C44892.80915610--

-------------------------------------------------------
This SF.Net email is sponsored by the new InstallShield X.
From Windows to Linux, servers to mobile, InstallShield X is the one
installation-authoring solution that does it all. Learn more and
evaluate today! http://www.installshield.com/Dev2Dev/0504
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode