|
Notes |
|
|
|
It seems that although flow is not listed in snort's preprocessors, it is still accepted as a valid preprocessor.
The problem is not there. It's more about the parameters. Here's the fix, change:
> - from: preprocessor flow: memcap 262144000, stats_interval 0, hash 2
> - to: preprocessor flow: memcap 262144000 stats_interval 0 hash 2
in conf/templates/snort.conf
I would need to test that in the lab. |
|
|
|
|
following the above comment guideline does get you further, however, as soon as pfdetect hooks on the var/alert file then snort issues a fatal error:
[root@pf-dev pf]# /usr/sbin/snort -u pf -c /usr/local/pf/conf/snort.conf -i eth1 -N -l /usr/local/pf/var
Running in IDS mode
--== Initializing Snort ==--
Initializing Output Plugins!
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file "/usr/local/pf/conf/snort.conf"
PortVar 'HTTP_PORTS' defined : [ 80 ]
PortVar 'SSH_PORTS' defined : [ 22 ]
PortVar 'ORACLE_PORTS' defined : [ 1521 ]
PortVar 'SHELLCODE_PORTS' defined : [ any ]
Tagged Packet Limit: 256
Log directory = /usr/local/pf/var
PerfMonitor config:
Time: 600 seconds
Flow Stats: ACTIVE
Event Stats: INACTIVE
Max Perf Stats: ACTIVE
Console Mode: INACTIVE
File Mode: /usr/local/pf/logs/snortstat
SnortFile Mode: INACTIVE
Packet Count: 90000
Dump Summary: No
Max file size: 2147483648
ERROR: /usr/local/pf/conf/snort.conf(25) Unknown preprocessor: "flow".
Fatal Error, Quitting..
|
|
|
|
|
|