Project

General

Profile

Actions

Bug #2033

closed

Snort needs a couple of variables for SIP rules

Added by Michele Di Maria over 12 years ago. Updated almost 12 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
Snort
Target version:
-
Start date:
11/29/2011
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Affected Version:
2.0
Affected Plus Version:
Affected Architecture:
i386

Description

Hi,
after the update of the rules of this night, Snort didn't restart successfully (curious because I didn't make any change to the config).
However after a bit of investigating, I found out that the problem was in Snort_Voip.Rules, where are defined the variables $SIP_SERVERS and $SIP_PORTS that I cannot set anywhere in the service interface (Snort 2.9.1 pkg v. 2.0).

The only workaround was to set in "Advanced configuration pass through" the following lines:
Var SIP_SERVERS $HOME_NET
Var SIP_PORTS [5060:5090,16384:32768]

then Snort started.

This two variables should be added to the "Define servers" page of the package, the values above are the known default for both options.

Thanks,
Michele

Actions

Also available in: Atom PDF