Regardin logs, if you are using -l path then check if snort can write to log directory.

Instruction says that config detection: search-method ac-bnfa max_queue_events 5 should be written on one line, not on two, and if you are writing them on 2 then you need “\” on the end of the first line.

The instructions say to use this:
config detection: search-method ac-bnfa
max_queue_events 5

But this is missing a “\” after “ac-bnfa” to ensure this is interpreted as one long command without an end-of-line. Alternatively, you can simply write it as
config detection: search-method ac-bnfa max_queue_events 5

As for problems incurred by an extra trailing “\”, make sure there is nothing on the line that follows, so that the command interpreter will pick up the end-of-line. “\” is just for readability. If your code is all mashed up so that one command follows another without a blank line, and you are using trailing “\”, then the interpreter won’t know where parameters end and the next command begins. For example, the code segment:

preprocessor ftp_telnet_protocol: \
preprocessor ftp_telnet_protocol: \

will try to be read as
preprocessor ftp_telnet_protocol: preprocessor ftp_telnet_protocol:

which is nonsense.

Make sure you have newlines where newlines are needed, and “\” where the command is NOT supposed to end.

BUT still I have trouble with snort. I try apacheDoS and guess what, Snort doesn’t write any log into alert.ids. But when I using nmap, Snort writes log. What wrong with that? Can you suggest me some more tools to test Snort?

Thank you so much.

Regarding stream5 preprocessor, I don’t know why is it complaining because stream5 should be in dynamic engine, there is no separate preprocessor .dll file for it.

Test with my config file and see what happens.

I don’t use IDSCenter, but I will give it a go to see what kind of problems are you having.

Exactly, I have problems with the preprocessor bo.

preprocessor bo

preprocessor frag3_global: max_frags 65536
preprocessor frag3_engine: policy windows timeout 180
preprocessor stream5_global: max_tcp 8192, track_tcp yes, track_udp yes
preprocessor stream5_tcp: policy windows, use_static_footprint_sizes,
preprocessor stream5_udp: ignore_any_rules
preprocessor http_inspect: global iis_unicode_map unicode.map 1252
preprocessor http_inspect_server: default_server
preprocessor ftp_telnet: \
preprocessor ftp_telnet_protocol: \
preprocessor ftp_telnet_protocol: \
preprocessor ftp_telnet_protocol: \
preprocessor SMTP: \
preprocessor ssh: server_ports { 22 } \
preprocessor ssl: ports { 443 465 563 636 989 992 993 994 995 7801 7702 7900 7901
7902 7903 7904 7905 7906 6907 7908 7909 7910 7911 7912 7913 7914 7915 7916 7917
7918 7919 7920 }, trustservers, noinspect_encrypted
preprocessor dcerpc2: memcap 102400, events [co ]
preprocessor dcerpc2_server: default, policy WinXP, \
preprocessor dns: ports { 53 } enable_rdata_overflow

This mess, from stream5 to the end of this. I always have trouble like “unknown preprocessor stream5″ or “must configure http inspect global configuration first” and so far, ftp_telnet, bla bla bla….

Thanks!!!!

ERROR: c:\snort\etc\snort.conf(273) Unknown rule type: max_queue_events.

I wonder what this problem is.

Tnx for the tip anyway.

ERROR: Invalid argument: preprocessor
Fatal Error, Quitting..

Reason why / is there is because / says that next line also is part of preprocessor configuration but I will check anyway.

Tnx for your comment.