snort-inline-users

[Snort-inline-users] Flowbits error

[<lma...@ar...>]

Hi,

i use snort_inline and I've got an error when i try to run it :

ERROR: FLOWBITS ERROR: The number of flowbit IDs in the current ruleset exceed the maximum number of IDs that are allowed.

I run version 2.3.0RC1 of snort_inline. I download the rules on snort.org and convert them with snortconfig (http://www.shmoo.com/~bmc/software/snortconfig/)

i search on the web and i found this mesage : 

http://www.mcabee.org/lists/snort-users/Mar-05/msg00410.html

but i can't update my snort version because i have to use snort_inline.

How can i resolve my problem?

Thanks in advance!

lm.

Re: [Snort-inline-users] Flowbits error

[Jason <sec...@br...>]

Check the archives. This was covered a while ago.

http://www.google.com/search?q=flowbits+error

lma...@ar... wrote:
> Hi,
> 
> i use snort_inline and I've got an error when i try to run it :
> 
> ERROR: FLOWBITS ERROR: The number of flowbit IDs in the current ruleset exceed the maximum number of IDs that are allowed.
> 
> I run version 2.3.0RC1 of snort_inline. I download the rules on snort.org and convert them with snortconfig (http://www.shmoo.com/~bmc/software/snortconfig/)
> 
> i search on the web and i found this mesage : 
> 
> http://www.mcabee.org/lists/snort-users/Mar-05/msg00410.html
> 
> but i can't update my snort version because i have to use snort_inline.
> 
> How can i resolve my problem?
> 
> Thanks in advance!
> 
> lm.
> 
> 
> 
> 
> 
> -------------------------------------------------------
> SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
> 

Re: [Snort-inline-users] Flowbits error

[Bert v. L. <ber...@gm...>]

I was under the impression all the newer versions of snort (from about
2.3.3onwards or so) include snort-inline by default? You just have to
enable the
option when using the configure script to build the code, then run snort=20
with the -Q option to make it use IP_QUEUE (same as snort_inline).

On 6/27/05, lma...@ar... <lma...@ar...> wrote:
>=20
>=20
> but i can't update my snort version because i have to use snort_inline.
>=20
>

Re: [Snort-inline-users] Flowbits error

[Lance S. <la...@ho...>]

On Jun 27, 2005, at 10:48, Bert van Leeuwen wrote:

> I was under the impression all the newer versions of snort (from about 
> 2.3.3 onwards or so) include snort-inline by default? You just have to 
> enable the option when using the configure script to build the code, 
> then run snort with the -Q option to make it use IP_QUEUE (same as 
> snort_inline).

Just curious.  Are you guys seeing the new pre-compiled versions (such 
as snort-rpm) with IP-QUEUE option enabled/compiled in?

lance

Re: [Snort-inline-users] Flowbits error

[Thanasin J. <tha...@gb...>]

The new version of snort + clamav patch can be found at
http://www.bleedingsnort.com/cgi-bin/viewcvs.cgi/?root=Snort-Clamav

It is snort-2.3.3-clam.tar.bz2

Regards,
Thanasin Jitkaew


lma...@ar... wrote:

>Hi,
>
>i use snort_inline and I've got an error when i try to run it :
>
>ERROR: FLOWBITS ERROR: The number of flowbit IDs in the current ruleset exceed the maximum number of IDs that are allowed.
>
>I run version 2.3.0RC1 of snort_inline. I download the rules on snort.org and convert them with snortconfig (http://www.shmoo.com/~bmc/software/snortconfig/)
>
>i search on the web and i found this mesage : 
>
>http://www.mcabee.org/lists/snort-users/Mar-05/msg00410.html
>
>but i can't update my snort version because i have to use snort_inline.
>
>How can i resolve my problem?
>
>Thanks in advance!
>
>lm.
>
>
>
>
>
>-------------------------------------------------------
>SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
>from IBM. Find simple to follow Roadmaps, straightforward articles,
>informative Webcasts and more! Get everything you need to get up to
>speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
>_______________________________________________
>Snort-inline-users mailing list
>Sno...@li...
>https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>
>
>  
>

Re: [Snort-inline-users] Flowbits error

[Will M. <wil...@gm...>]

List,=20

I promise that we will have a new release out soon, we are ironing out
some bugs in stream4inline.

Regards,

Will

On 6/27/05, Thanasin Jitkaew <tha...@gb...> wrote:
> The new version of snort + clamav patch can be found at
> http://www.bleedingsnort.com/cgi-bin/viewcvs.cgi/?root=3DSnort-Clamav
>=20
> It is snort-2.3.3-clam.tar.bz2
>=20
> Regards,
> Thanasin Jitkaew
>=20
>=20
> lma...@ar... wrote:
>=20
> >Hi,
> >
> >i use snort_inline and I've got an error when i try to run it :
> >
> >ERROR: FLOWBITS ERROR: The number of flowbit IDs in the current ruleset =
exceed the maximum number of IDs that are allowed.
> >
> >I run version 2.3.0RC1 of snort_inline. I download the rules on snort.or=
g and convert them with snortconfig (http://www.shmoo.com/~bmc/software/sno=
rtconfig/)
> >
> >i search on the web and i found this mesage :
> >
> >http://www.mcabee.org/lists/snort-users/Mar-05/msg00410.html
> >
> >but i can't update my snort version because i have to use snort_inline.
> >
> >How can i resolve my problem?
> >
> >Thanks in advance!
> >
> >lm.
> >
> >
> >
> >
> >
> >-------------------------------------------------------
> >SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> >from IBM. Find simple to follow Roadmaps, straightforward articles,
> >informative Webcasts and more! Get everything you need to get up to
> >speed, fast. http://ads.osdn.com/?ad_id=3D7477&alloc_id=3D16492&op=3Dcli=
ck
> >_______________________________________________
> >Snort-inline-users mailing list
> >Sno...@li...
> >https://lists.sourceforge.net/lists/listinfo/snort-inline-users
> >
> >
> >
> >
>=20
>=20
>=20
> -------------------------------------------------------
> SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast. http://ads.osdn.com/?ad_id=3D7477&alloc_id=3D16492&op=3Dclic=
k
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>