Re: [Snortsam-discussion] HELP:setting upSnortSamrunsSnort-2.8.0+BASE+Barnyard

[Rachmat Hidayat Al-Anshar <rachmat_hidayat_02 () yahoo com>]

Hi Anthony, it's look like u didn't notice this topic from the beginning, 

I do download the SnortSam patch for Snort-2.8.0 from the http://www.snortsam.net/files/snort-2.8-plugin/


Thanks for the response
(^^!) rachmat


----- Original Message ----
From: Anthony Rodgers <Anthony_Rodgers () dnv org>
To: snortsam-discussion () snortsam net
Cc: Joel Esler <joel.esler () sourcefire com>
Sent: Friday, November 9, 2007 4:31:35 AM
Subject: Re: [Snortsam-discussion] [Snort-users] HELP:setting upSnortSamrunsSnort-2.8.0+BASE+Barnyard

But I fixed it already.....

http://www.bleedingthreats.net/index.php/2007/10/25/snortsam-patch-for-s
nort-28-available/

If that still doesn't work, let me know.......

CP 

-----Original Message-----
From: snortsam-discussion-bounces () snortsam net
[mailto:snortsam-discussion-bounces () snortsam net] On Behalf Of Matt
Jonkman
Sent: Wednesday, November 07, 2007 8:32 PM
To: snortsam-discussion () snortsam net
Cc: Joel Esler; Snort-users () lists sourceforge net
Subject: Re: [Snortsam-discussion] [Snort-users] HELP:setting
upSnortSamrunsSnort-2.8.0+BASE+Barnyard

It does not yet. It's not been modified for 2.8 correctly yet.

I'll announce as soon as it is...

Matt

Anthony Rodgers wrote:
> The patch is supposed to supply a patched call to RegisterPlugin() - 
> if it doesn't, I'd like to know......
>
> CP
>
> -----Original Message-----
> From: snortsam-discussion-bounces () snortsam net
> [mailto:snortsam-discussion-bounces () snortsam net] On Behalf Of Will 
> Metcalf
> Sent: Saturday, November 03, 2007 6:46 AM
> To: Joel Esler
> Cc: Snort-users () lists sourceforge net; 
> snortsam-discussion () snortsam net
> Subject: Re: [Snortsam-discussion] [Snort-users] HELP: setting 
> upSnortSamrunsSnort-2.8.0+BASE+Barnyard
>
> It appears as if the patch is broken.  It looks like RegisterPlugin 
> requires an OptType in 2.8 and whoever updated the patch did not 
> specify one.  so In spo_alert_fwsam.c
>
> RegisterPlugin("fwsam", AlertFWsamOptionInit);
>
> Needs to be something like....
>
> RegisterPlugin("fwsam", AlertFWsamOptionInit,OPT_TYPE_ACTION);
>
> here are the opt types you can specify.  I'm not sure which does
 what,

> maybe Joel can clarify the correct one to use.  Need to go pack now, 
> getting ready for an 11 hour flight ;-)...
>
>         OPT_TYPE_ACTION = 0,
>         OPT_TYPE_LOGGING,
>         OPT_TYPE_DETECTION,
>         OPT_TYPE_MAX
>
> Regards,
>
> Will
> On 11/3/07, Joel Esler <joel.esler () sourcefire com> wrote:
> > What version of Snort are you running?
> > Is SnortSAM compatible with that version?
> >
> > Did you notice you typed "--with-ysql-libraries" instead of 
> > "--with-mysql-libraries".
> >
> > In addition to that, I recommend you do NOT have Snort log directly 
> > to
>
> > the DB, instead, use Snort to log to unified, then have a separate 
> > tool named "barnyard" to insert the unified files into the DB.
> >
> > J
> >
> >
> >
> > On Nov 3, 2007, at 1:49 AM, Rachmat Hidayat Al-Anshar wrote:
> >
> >
> > All right then,
> > I've been trying to going through this process with ignoring the 
> > warning message produced by aclocal.
> > The proccess continued
> >
> > # autoheader
> > # automake -add-missing
> > # autoconf
> > #./configure --enable-dynamicplugin
> > --with-mysql-includes=/usr/include/mysql
> > --with-ysql-libraries=/usr/lib
> >
> > and suddenly...
> >
> > spo_alert_fwsam.c: In function 'AlertFWsamSetup':
> > spo_alert_fwsam.c:143: warning: passing arg 3 of 
> > 'RegisterOutputPlugin' from incompatible pointer type
> > spo_alert_fwsam.c:144: error: too few arguments to function
> 'RegisterPlugin'
> > spo_alert_fwsam.c: In function 'AlertFWsam':
> > spo_alert_fwsam.c:905: warning: passing arg 2 of 'TwoFishEncrypt' 
> > from
>
> > incompatible pointer type
> > spo_alert_fwsam.c:940: warning: passing arg 2 of 'TwoFishDecrypt' 
> > from
>
> > incompatible pointer type
> > spo_alert_fwsam.c:946: warning: passing arg 2 of 'TwoFishDecrypt' 
> > from
>
> > incompatible pointer type
> > spo_alert_fwsam.c:979: warning: passing arg 2 of 'TwoFishDecrypt' 
> > from
>
> > incompatible pointer type
> > spo_alert_fwsam.c:985: warning: passing arg 2 of 'TwoFishDecrypt' 
> > from
>
> > incompatible pointer type
> > spo_alert_fwsam.c: In function 'FWsamCheckOut':
> > spo_alert_fwsam.c:1141: warning: passing arg 2 of 'TwoFishEncrypt' 
> > from incompatible pointer type
> > spo_alert_fwsam.c:1157: warning: passing arg 2 of 'TwoFishDecrypt' 
> > from incompatible pointer type
> > spo_alert_fwsam.c:1163: warning: passing arg 2 of 'TwoFishDecrypt' 
> > from incompatible pointer type
> > spo_alert_fwsam.c: In function 'FWsamCheckIn':
> > spo_alert_fwsam.c:1274: warning: passing arg 2 of 'TwoFishEncrypt' 
> > from incompatible pointer type
> > spo_alert_fwsam.c:1293: warning: passing arg 2 of 'TwoFishDecrypt' 
> > from incompatible pointer type
> > make[3]: *** [spo_alert_fwsam.o] Error 1
> > make[3]: Leaving directory
> '/research/snort/snort-2.8.0/src/output-plugins'
> > make[2]: *** [all-recursive] Error 1
> > make[2]: Leaving directory '/research/snort/snort-2.8.0/src'
> > make[1]: *** [all-recursive] Error 1
> > make[1]: Leaving directory '/research/snort/snort-2.8.0'
> > make: *** [all] Error 2
> >
> > What's wrong with snort?!
> > How to solve this?
> >
> > Any response will be appreciated
> > Thanks
> > (^^!) Mat
> >
> > __________________________________________________
> > Do You Yahoo!?
> > Tired of spam? Yahoo! Mail has the best spam protection around 
> > http://mail.yahoo.com
 ---------------------------------------------------------------------
> > -
> > --- This SF.net email is sponsored by: Splunk Inc.
> > Still grepping through log files to find problems?  Stop.
> > Now Search log events and configuration files using AJAX and a
> browser.
> > Download your FREE copy of Splunk now >> 
 http://get.splunk.com/_______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
 ---------------------------------------------------------------------
> > -
> > --- This SF.net email is sponsored by: Splunk Inc.
> > Still grepping through log files to find problems?  Stop.
> > Now Search log events and configuration files using AJAX and a
> browser.
> > Download your FREE copy of Splunk now >> http://get.splunk.com/ 
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> _______________________________________________
> Snortsam-discussion mailing list
> Snortsam-discussion () snortsam net
> http://lists.snortsam.net/mailman/listinfo/snortsam-discussion
> _______________________________________________
> Snortsam-discussion mailing list
> Snortsam-discussion () snortsam net
> http://lists.snortsam.net/mailman/listinfo/snortsam-discussion

--
--------------------------------------------
Matthew Jonkman
Bleeding Edge Threats
US Phone 765-429-0398
US Fax 312-264-0205
AUS Phone 61-42-4157-491
AUS Fax 61-29-4750-026
http://www.bleedingthreats.net
--------------------------------------------

PGP: http://www.bleedingthreats.com/mattjonkman.asc


_______________________________________________
Snortsam-discussion mailing list
Snortsam-discussion () snortsam net
http://lists.snortsam.net/mailman/listinfo/snortsam-discussion
_______________________________________________
Snortsam-discussion mailing list
Snortsam-discussion () snortsam net
http://lists.snortsam.net/mailman/listinfo/snortsam-discussion





__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users