Actions
Bug #2033
closedSnort needs a couple of variables for SIP rules
Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
Snort
Target version:
-
Start date:
11/29/2011
Due date:
% Done:
0%
Estimated time:
Plus Target Version:
Affected Version:
2.0
Affected Plus Version:
Affected Architecture:
i386
Description
Hi,
after the update of the rules of this night, Snort didn't restart successfully (curious because I didn't make any change to the config).
However after a bit of investigating, I found out that the problem was in Snort_Voip.Rules, where are defined the variables $SIP_SERVERS and $SIP_PORTS that I cannot set anywhere in the service interface (Snort 2.9.1 pkg v. 2.0).
The only workaround was to set in "Advanced configuration pass through" the following lines:
Var SIP_SERVERS $HOME_NET
Var SIP_PORTS [5060:5090,16384:32768]
then Snort started.
This two variables should be added to the "Define servers" page of the package, the values above are the known default for both options.
Thanks,
Michele
Actions