Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've installed "Snort" on FreeBSD-9.1 (32-bit) from the standard ports using:

pkg_add -r snort

After configuring and running with:

snort -c /etc/snort/snort.conf -A full -u snort -g snort -i em1 -T

I'm getting this error:

ERROR: /etc/snort/snort.conf(337) Unknown preprocessor: "ftp_telnet".

Doing some search on the Internet, the only thing I found is that this could happen if I'm using a snort.conf with a different version from snort itself, but this is not my case. My snort version is:

 ,,_     -*> Snort! <*-
o"  )~   Version 2.9.3.1 IPv6 GRE (Build 40) 
 ''''    By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
         Copyright (C) 1998-2012 Sourcefire, Inc., et al.
         Using libpcap version 1.3.0
         Using PCRE version: 8.31 2012-07-06
         Using ZLIB version: 1.2.7

and I'm using snortrules-snapshot-2931.tar.gz from snort.org.

I've had some previous experience installing and running snort on Linux and I never faced such errors, but I'm fairly new to BSD-UNIX.

Can anyone help?

share|improve this question
    
No one answered this question in a long time, and all my attempts failed to solve it and the importance of this has now passed for me ... But for anyone else who might face this issue, I think the cause of the problem is that I installed Snort from the ports ... I haven't tried it yet but my best guess is that if I try and install this from source, this problem won't show up ... So, in short: Try installing Snort from source and not from the ports. –  Seyed Mohammad May 3 '13 at 13:05

1 Answer 1

No one answered this question in a long time, and all my attempts failed to solve it and the importance of this has now passed for me ... But for anyone else who might face this issue, I think the cause of the problem is that I installed Snort from the ports ... I haven't tried it yet but my best guess is that if I try and install this from source, this problem won't show up.

So, in short: Try installing Snort from source and not from the ports. Here is a useful link on installing Snort from source on FreeBSD-9:

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.