Issues with Snort
"Bill Young" <[email protected]> Thu, 5 Jun 2003 18:00:50 -0700
| Newsgroups | gmane.comp.security.ids.snort.snarf |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. ------=_NextPart_000_008B_01C32B8C.6BA272D0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Howdy, I have an issue running snortsnarf. I got through previous issues but = ended up getting repeated errors of "ran out of memory" this on a 1.5 Ghz processor with 640 meg of ram running Windows and Perl 5.6. Switched to another box stripped down that has a 2.5 ghz processor and a gig of = memory. It took forever to run similar to the 1.5 but after an an intial stage = of 100% processor utilization starts alerting on errors "Use of unitialized value in numeric comparison <<=3D>> at include/Snortsnarf/Mem = timebase.pm line 69, <inputfile001> line [here it just increments through]. =20 Has anyone seen this and any possible workarounds. I have down loaded = the Timemodules. The makefile portion part of the instructions works for me = but the rest do not, make, make test etc. I am a Perl wannabe but trying to = get better. Perhaps I am missing something there. From an earlier post I = copied the time modules to my perl lib directory and that seemed to get rid of = some initial errors but after the long delay I am getting the "Use of = unitialized value in numeric comparison". =20 =20 Final issue I have been having is that I am looking at some alert data = from http://www.incidents.org/logs/. I keep getting the following errors = on the alert file. The scan file is ok other than the errors above. ------------------------------------------------------------------- unknown alert format for line: :1025 -> MY.NET.236.198:137 ; skipping unknown alert format for line: :65535 -> MY.NET.97.91:3411 ; skipping ------------------------------------------------------------------ =20 Yet review of the file does not show any corruption.=20 =20 Appreciate any help with this. =20 =20 And thanks to Jim Grossl for previous help. =20 Cheers, Bill ------=_NextPart_000_008B_01C32B8C.6BA272D0 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = charset=3Dus-ascii"> <TITLE>Message</TITLE> <META content=3D"MSHTML 6.00.2726.2500" name=3DGENERATOR></HEAD> <BODY> <DIV><SPAN class=3D367183800-06062003><FONT face=3DArial=20 size=3D2>Howdy,</FONT></SPAN></DIV> <DIV><SPAN class=3D367183800-06062003><FONT face=3DArial size=3D2>I have = an issue=20 running snortsnarf. I got through previous issues but ended up = getting=20 repeated errors of "ran out of memory" this on a 1.5 Ghz processor with = 640 meg=20 of ram running Windows and Perl 5.6. Switched to another box = stripped down=20 that has a 2.5 ghz processor and a gig of memory. It took forever = to run=20 similar to the 1.5 but after an an intial stage of 100% processor = utilization=20 starts alerting on errors "Use of unitialized value in numeric = comparison=20 <<=3D>> at include/Snortsnarf/Mem timebase.pm line 69,=20 <inputfile001> line [here it just increments = through].</FONT></SPAN></DIV> <DIV><SPAN class=3D367183800-06062003><FONT face=3DArial=20 size=3D2></FONT></SPAN> </DIV> <DIV><SPAN class=3D367183800-06062003><FONT face=3DArial size=3D2>Has = anyone seen this=20 and any possible workarounds. I have down loaded the = Timemodules. =20 The makefile portion part of the instructions works for me but the rest = do not,=20 make, make test etc. I am a Perl wannabe but trying to get better. = Perhaps=20 I am missing something there. From an earlier post I copied = the time=20 modules to my perl lib directory and that seemed to get rid of some = initial=20 errors but after the long delay I am getting the "Use of = unitialized value=20 in numeric comparison". </FONT></SPAN></DIV> <DIV><SPAN class=3D367183800-06062003><FONT face=3DArial=20 size=3D2></FONT></SPAN> </DIV> <DIV><SPAN class=3D367183800-06062003><FONT face=3DArial size=3D2>Final = issue I have=20 been having is that I am looking at some alert data from <A=20 href=3D"http://www.incidents.org/logs/">http://www.incidents.org/logs/</A= >. =20 I keep getting the following errors on the alert file. The scan = file is ok=20 other than the errors above.</FONT></SPAN></DIV> <DIV><SPAN class=3D367183800-06062003><FONT face=3DArial=20 size=3D2>----------------------------------------------------------------= ---</FONT></SPAN></DIV> <DIV><SPAN class=3D367183800-06062003><FONT face=3DArial = size=3D2>unknown alert format=20 for line: :1025 -> MY.NET.236.198:137<BR>; skipping<BR>unknown alert = format=20 for line: :65535 -> MY.NET.97.91:3411<BR>; = skipping</FONT></SPAN></DIV> <DIV><SPAN class=3D367183800-06062003><FONT face=3DArial=20 size=3D2>----------------------------------------------------------------= --</FONT></SPAN></DIV> <DIV><SPAN class=3D367183800-06062003><FONT face=3DArial=20 size=3D2></FONT></SPAN> </DIV> <DIV><SPAN class=3D367183800-06062003><FONT face=3DArial size=3D2>Yet = review of the=20 file does not show any corruption. </FONT></SPAN></DIV> <DIV><SPAN class=3D367183800-06062003><FONT face=3DArial=20 size=3D2></FONT></SPAN> </DIV> <DIV><SPAN class=3D367183800-06062003><FONT face=3DArial = size=3D2>Appreciate any help=20 with this. </FONT></SPAN></DIV> <DIV><SPAN class=3D367183800-06062003><FONT face=3DArial=20 size=3D2></FONT></SPAN> </DIV> <DIV><SPAN class=3D367183800-06062003><FONT face=3DArial size=3D2>And = thanks to Jim=20 Grossl for previous help.</FONT></SPAN></DIV> <DIV><SPAN class=3D367183800-06062003><FONT face=3DArial=20 size=3D2></FONT></SPAN> </DIV> <DIV><SPAN class=3D367183800-06062003><FONT face=3DArial=20 size=3D2>Cheers,</FONT></SPAN></DIV> <DIV><SPAN class=3D367183800-06062003><FONT face=3DArial=20 size=3D2>Bill</FONT></SPAN></DIV></BODY></HTML> ------=_NextPart_000_008B_01C32B8C.6BA272D0--