OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: [Snort-users] ERROR: Preprocessor already registered with ID 21

From: Russ Combs (rcombssourcefire.com)
Date: Mon Aug 30 2010 - 09:31:47 CDT


On Fri, Aug 27, 2010 at 9:54 PM, waldo kitty <wkitty42windstream.net>wrote:

> On 8/26/2010 19:07, Russ Combs wrote:
> >
> >
> > On Thu, Aug 26, 2010 at 6:44 PM, Richard Martin <
> richard.martin1980gmail.com
> > <mailto:richard.martin1980gmail.com>> wrote:
> >
> > ERROR: Preprocessor already registered with ID 21
> > Fatal Error, Quitting..
> >
> > Any ideas?
> >
> > Looks like you've got two or more of preprocessor X lines in your conf
> (ie the
> > same one repeated). Not sure which though.
>
> shouldn't snort tell which preprocessor it is? ;)
>

Yeah - you would think - but the Snort code doesn't facilitate that.
Looking into why that isn't provided I realized my earlier thought wasn't
correct:

* If you have two preprocessor X lines you will get a preprocessor specific
error message.

* If the RegisterPreprocessor function is called more than once for a given
preprocessor, you get "Duplicate preprocessor keyword: <name>".

* If the registered init function installs a preprocessor function twice, or
two different preprocessors try to install an API function with the same
preprocessor ID, you will get "Preprocessor already registered with ID
<id>".

My guess is that in this case a new preprocessor was created that uses the
same ID as another.

>
>
> ------------------------------------------------------------------------------
> Sell apps to millions through the Intel(R) Atom(Tm) Developer Program
> Be part of this innovative community and reach millions of netbook users
> worldwide. Take advantage of special opportunities to increase revenue and
> speed time-to-market. Join now, and jumpstart your future.
> http://p.sf.net/sfu/intel-atom-d2d
> _______________________________________________
> Snort-users mailing list
> Snort-userslists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>

------------------------------------------------------------------------------
Sell apps to millions through the Intel(R) Atom(Tm) Developer Program
Be part of this innovative community and reach millions of netbook users
worldwide. Take advantage of special opportunities to increase revenue and
speed time-to-market. Join now, and jumpstart your future.
http://p.sf.net/sfu/intel-atom-d2d

_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users