LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 08-29-2011, 10:54 AM   #1
mhollis
LQ Newbie
 
Registered: Aug 2011
Posts: 10

Rep: Reputation: Disabled
Snort - DynamicPlugin: Rule [##] not enabled in configuration, rule will not be used


I restarted my snort machine today. When I started snort back up I got a lot of the following messages. I don't remember If I got these messages before or not. I still receive alerts in snort though. Can someone explain what these messages mean. I read one thread stating that these were normal, but there wasn't an explanation. Thanks.

DynamicPlugin: Rule [3:16389] not enabled in configuration, rule will not be used.
DynamicPlugin: Rule [3:16419] not enabled in configuration, rule will not be used.
DynamicPlugin: Rule [3:16420] not enabled in configuration, rule will not be used.
DynamicPlugin: Rule [3:16510] not enabled in configuration, rule will not be used.
DynamicPlugin: Rule [3:16511] not enabled in configuration, rule will not be used.
DynamicPlugin: Rule [3:16559] not enabled in configuration, rule will not be used.
DynamicPlugin: Rule [3:17037] not enabled in configuration, rule will not be used.
DynamicPlugin: Rule [3:17770] not enabled in configuration, rule will not be used.
DynamicPlugin: Rule [3:17772] not enabled in configuration, rule will not be used.
DynamicPlugin: Rule [3:18197] not enabled in configuration, rule will not be use

Last edited by mhollis; 08-29-2011 at 10:55 AM.
 
Old 08-29-2011, 02:45 PM   #2
Noway2
Senior Member
 
Registered: Jul 2007
Distribution: Gentoo
Posts: 2,125

Rep: Reputation: 780Reputation: 780Reputation: 780Reputation: 780Reputation: 780Reputation: 780Reputation: 780
Welcome to the world of Snort. There is a fairly new addition to Snort called the dynamic plugins which, if I recall correctly, require a rule set the is pre-compiled and then loaded on your system. One of the steps in the installation process (depending on distribution) is compiling this rule set and then placing them in your rules folder. In addition, these rules need to be enabled in the configuration file(s). According to this link, this error message means that the rules (.so files) have been included, but rules haven't been enabled.
 
Old 08-29-2011, 03:30 PM   #3
mhollis
LQ Newbie
 
Registered: Aug 2011
Posts: 10

Original Poster
Rep: Reputation: Disabled
I have snort2-9.0.5 installed on Ubuntu 10.04 LTS. If I go to the directory that my snort rules are stored (/usr/local/snort) I see a folder called so_rules. So I guess the regular snort rules and so_rules are totally different rules.
 
Old 08-29-2011, 06:06 PM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,409
Blog Entries: 55

Rep: Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582
...in addition you might not have done a 'snort --dump-dynamic-rules'. (And for a more thorough run-through of loading dynamic plugins, which you could use as a checklist, see this.)

*BTW I'll move this thread to the Software forum as it isn't about Snort in the security sense but configuring Snort.
 
1 members found this post helpful.
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Snort Rule for Buffer overflow Fracker Linux - Security 1 02-16-2010 09:54 AM
Help with my snort rule set PixelCloud Linux - Security 1 07-17-2004 01:35 PM
snort rule update script netmon Linux - General 1 10-03-2003 06:31 PM
Snort, P2P rule and 1432 Alert.... shelby Linux - Security 1 06-20-2003 02:10 PM
Snort, test rule, XST unSpawn Linux - Security 0 01-22-2003 06:53 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 03:35 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration