Re: Snort Error Message Using spade configuration

[Mahdi Kefayati <kefaiati () yahoo com>]

In the Name of the Dearest 
Dear Jim, 
I'm using Spade-030125.1 downloaded from silicon defense's official web site On Redhat Linux 8.0, kernel 2.4.20, and 
I'd no problem with my spade until I extended my spade rules, i. e. preproccesssors. Now I get segmentation fault 
problems while running snort using spade specific config file, I just added the previously learned thresholds and 
adjusted reporting times. Also I add surveying, threshold advising and threshold adjusting facilities for each 
detector. 
Another thing I want to ask you is that what is the string that auto threshold adjusting facility uses when alerting 
new thresholds, ofcource if any, I saw "spp_anomsensor: Threshold adjusted to 9.9015 after 2 alerts (of 13)" for 
example in a document. But when I saw the probably new style of alerts in my alerts database i.e. "Spade: Closed dest 
port used: local dest, est. flags: 1.0000" I thought that the style might have changed. I browsed the source code for a 
clue but besides the fact that I learned much about snort but I could not find things I wanted. I want to know the 
exact style of the alerts in order to run queries against alerts database to get neat reports, etc. 
Thanks for your help and regards, 
Mahdi Kefayati 
 James Hoagland <jim () SiliconDefense com> wrote: Mahdi,

At 3:09 AM -0800 3/1/03, Mahdi Kefayati wrote:
> In the Name of the Dearest
>
> Hi all,
>
> When I run my snort using a config file only
> containing spade preproccessors I get message
> "Segmentation fault" and snort terminates.

Again, let me ask for what version of Spade you are using. You 
previously indicated it was the version that came with snort 1.9.0, 
but none of the distributions of snort 1.9.0 that I know of come with 
Spade. There was a segmentation fault fixed in the most recent Spade 
release (a bad interaction with stream4).

Better yet, why not download Spade from the Silicon Defense web site 
again and apply it to a clean snort distribution. That way you know 
you'll be using version 030125.1.

Best regards,

Jim

> Anybody who has any idea please tell me,
>
> Regards,
> Mahdi Kefayati
>
> __________________________________________________
> Do you Yahoo!?
> Yahoo! Tax Center - forms, calculators, tips, more
> http://taxes.yahoo.com/
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-- 
|* Jim Hoagland, Associate Researcher, Silicon Defense *|
|* --- Silicon Defense: The Cyberwar Defense Company --- *|
|* jim () SiliconDefense com, http://www.silicondefense.com/ *|
|* Voice: (530) 756-7317 Fax: (530) 756-7297 *|


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


---------------------------------
Do you Yahoo!?
Yahoo! Tax Center - forms, calculators, tips, and more