Project

General

Profile

Bug #2033

Snort needs a couple of variables for SIP rules

Added by Michele Di Maria over 7 years ago. Updated about 7 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
Snort
Target version:
-
Start date:
11/29/2011
Due date:
% Done:

0%

Estimated time:
Affected Version:
2.0
Affected Architecture:
i386

Description

Hi,
after the update of the rules of this night, Snort didn't restart successfully (curious because I didn't make any change to the config).
However after a bit of investigating, I found out that the problem was in Snort_Voip.Rules, where are defined the variables $SIP_SERVERS and $SIP_PORTS that I cannot set anywhere in the service interface (Snort 2.9.1 pkg v. 2.0).

The only workaround was to set in "Advanced configuration pass through" the following lines:
Var SIP_SERVERS $HOME_NET
Var SIP_PORTS [5060:5090,16384:32768]

then Snort started.

This two variables should be added to the "Define servers" page of the package, the values above are the known default for both options.

Thanks,
Michele

History

#1 Updated by Scott Ullrich over 7 years ago

Thanks!

#2 Updated by Scott Ullrich over 7 years ago

  • Status changed from New to Feedback

#3 Updated by Michele Di Maria over 7 years ago

I updated the package, the service started at the "second try", but sometimes Snort does it after an update.

Btw, thanks to you all!
Michele

#4 Updated by Michele Di Maria over 7 years ago

I made a fix to this change waiting for merge... sorry, this time I tested on both machines.

#5 Updated by Jim Pingle about 7 years ago

  • Status changed from Feedback to Resolved

Also available in: Atom PDF