Re: [Snort-users] stream5 issues

Hello,

If you are going to track TCP and or UDP you need to provide the
configuration lines for those. even if the line is empty.
i.e.

preprocessor stream5_tcp: policy first, use_static_footprint_sizes
preprocessor stream5_udp:

or

preprocessor stream5_tcp:
preprocessor stream5_udp:

Hope that helps,
Keith

John Hally wrote:
> Hello all,
>
> running into an issue that I'm stumped on. when setting up stream5 I'm
> getting the following:
>
> snort[15925]: WARNING: Stream5 TCP default policy not specified in
> configuration
>
> snort[15925]: WARNING: Stream5 TCP misconfigured
>
> snort[15925]: FATAL ERROR: Stream5 not properly configured... exiting
>
> the problem is the stream5 setup is minimal:
>
> preprocessor stream5_global: track_tcp yes, track_udp yes, track_icmp no
>
> preprocessor stream5_udp: ignore_any_rules
>
> preprocessor stream5_tcp: bind_to any, policy windows, detect_anomalies
>
>
> does anyone see anything wrong?
>
> thanks!
>
> John.
>
>
>
> ------------------------------------------------------------------------
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
> Register now and save $200. Hurry, offer ends at 11:59 p.m.,
> Monday, April 7! Use priority code J8TLD2.
> http://ad.doubleclick.net/clk;198757...un.com/javaone
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/...fo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.p...st=snort-users


-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Register now and save $200. Hurry, offer ends at 11:59 p.m.,
Monday, April 7! Use priority code J8TLD2.
http://ad.doubleclick.net/clk;198757...un.com/javaone
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users