Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've installed "Snort" on FreeBSD-9.1 (32-bit) from the standard ports using:

pkg_add -r snort

After configuring and running with:

snort -c /etc/snort/snort.conf -A full -u snort -g snort -i em1 -T

I'm getting this error:

ERROR: /etc/snort/snort.conf(337) Unknown preprocessor: "ftp_telnet".

Doing some search on the Internet, the only thing I found is that this could happen if I'm using a snort.conf with a different version from snort itself, but this is not my case. My snort version is:

 ,,_     -*> Snort! <*-
o"  )~   Version 2.9.3.1 IPv6 GRE (Build 40) 
 ''''    By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
         Copyright (C) 1998-2012 Sourcefire, Inc., et al.
         Using libpcap version 1.3.0
         Using PCRE version: 8.31 2012-07-06
         Using ZLIB version: 1.2.7

and I'm using snortrules-snapshot-2931.tar.gz from snort.org.

I've had some previous experience installing and running snort on Linux and I never faced such errors, but I'm fairly new to BSD-UNIX.

Can anyone help?

share|improve this question
    
No one answered this question in a long time, and all my attempts failed to solve it and the importance of this has now passed for me ... But for anyone else who might face this issue, I think the cause of the problem is that I installed Snort from the ports ... I haven't tried it yet but my best guess is that if I try and install this from source, this problem won't show up ... So, in short: Try installing Snort from source and not from the ports. –  Seyed Mohammad May 3 '13 at 13:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.