Re: Fatal Error stream5 TCP Policy

[Nigel Houghton <nhoughton () sourcefire com>]

On Thu, Oct 29, 2009 at 10:42 AM,  <alessandrorguard-snortml () yahoo it> wrote:
> Hi snort user!
> I'm using an ubuntu 9.04 server distro and i'm trying to setup snort with inline.
> Everything ok (I think...) in installation and download rules with oinkmaster.
> I
> modified a bit snort.conf, commenting all preprocessor lines except
> stream5 and sfportscan, leaving their configuration parameters I found
> in the files.
> When i try to run snort with:
> sudo snort -c /etc/snort/snort.conf -de -n 10 -l ./test_log_dir -K ascii &
> the last lines i get are:
> Error: Tried to config stream5TCP policy without global config!
> Fatal error, Quitting...
>
> In snort.conf i have:
> preprocessor stream5_tcp: policy first, use_static_footprint_sizes
> preprocessor stream5_udp: ignore_any_rules
>
> Any hint to solve problem?
>
> Alessandro
>
>
>
>
> ------------------------------------------------------------------------------
> Come build with us! The BlackBerry(R) Developer Conference in SF, CA
> is the only developer event you need to attend this year. Jumpstart your
> developing skills, take BlackBerry mobile applications to market and stay
> ahead of the curve. Join us from November 9 - 12, 2009. Register now!
> http://p.sf.net/sfu/devconference
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


Yes, you need a global config for stream5 like the error says.

Look in the snort.conf (the default one with the tarball) and look for
preprocessor stream5_global: blah blah blah....

-- 
Nigel Houghton
Head Mentalist
SF VRT
http://vrt-sourcefire.blogspot.com && http://www.snort.org/vrt/

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay 
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users