Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

[Snort-users] Unknown ClassType: protocol-command-decode

2,586 views
Skip to first unread message

Avery Rozar

unread,
Aug 13, 2013, 1:55:44 PM8/13/13
to
I just installed Snort 2.9.5.3. Ran pulled pork with "snort_version=2.9.5.3".

When I try starting snort, it errors out. Below is the error. At first I was thinking maybe I uploaded the wrong rules, but the config looks good.

Initializing rule chains...
ERROR: /etc/snort/rules/snort.rules(8) Unknown ClassType: protocol-command-decode
Fatal Error, Quitting..

,,_ -*> Snort! <*-
o" )~ Version 2.9.5.3 GRE (Build 132)
'''' By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
Copyright (C) 1998-2013 Sourcefire, Inc., et al.
Using libpcap version 1.0.0
Using PCRE version: 7.8 2008-09-05
Using ZLIB version: 1.2.3




------------------------------------------------------------------------------
Get 100% visibility into Java/.NET code with AppDynamics Lite!
It's a free troubleshooting tool designed for production.
Get down to code-level detail for bottlenecks, with <2% overhead.
Download for free and get started troubleshooting in minutes.
http://pubads.g.doubleclick.net/gampad/clk?id=48897031&iu=/4140/ostg.clktrk
_______________________________________________
Snort-users mailing list
Snort...@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Y M

unread,
Aug 13, 2013, 2:12:31 PM8/13/13
to
Can you please post the rule that is causing the error? Probably starting at line 8 in your snort.conf. Also post the rule before and the one after.

Avery Rozar

unread,
Aug 13, 2013, 2:25:03 PM8/13/13
to
All, I found the issue. My classification.config was jacked up, not sure how it happened. I copied a new one from the /src folder I installed everything from.

Thank you,
Avery

From: Y M <sn...@outlook.com<mailto:sn...@outlook.com>>
Date: Tuesday, August 13, 2013 2:12 PM
To: Avery Rozar <Avery...@i-techsupport.com<mailto:Avery...@i-techsupport.com>>, "snort...@lists.sourceforge.net<mailto:snort...@lists.sourceforge.net>" <snort...@lists.sourceforge.net<mailto:snort...@lists.sourceforge.net>>
Subject: RE: [Snort-users] Unknown ClassType: protocol-command-decode

Can you please post the rule that is causing the error? Probably starting at line 8 in your snort.conf. Also post the rule before and the one after.


> From: Avery...@i-techsupport.com<mailto:Avery...@i-techsupport.com>
> To: snort...@lists.sourceforge.net<mailto:snort...@lists.sourceforge.net>
> Date: Tue, 13 Aug 2013 17:55:44 +0000
> Subject: [Snort-users] Unknown ClassType: protocol-command-decode
>
> I just installed Snort 2.9.5.3. Ran pulled pork with "snort_version=2.9.5.3".
>
> When I try starting snort, it errors out. Below is the error. At first I was thinking maybe I uploaded the wrong rules, but the config looks good.
>
> Initializing rule chains...
> ERROR: /etc/snort/rules/snort.rules(8) Unknown ClassType: protocol-command-decode
> Fatal Error, Quitting..
>
> ,,_ -*> Snort! <*-
> o" )~ Version 2.9.5.3 GRE (Build 132)
> '''' By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
> Copyright (C) 1998-2013 Sourcefire, Inc., et al.
> Using libpcap version 1.0.0
> Using PCRE version: 7.8 2008-09-05
> Using ZLIB version: 1.2.3
>
>
>
>
> ------------------------------------------------------------------------------
> Get 100% visibility into Java/.NET code with AppDynamics Lite!
> It's a free troubleshooting tool designed for production.
> Get down to code-level detail for bottlenecks, with <2% overhead.
> Download for free and get started troubleshooting in minutes.
> http://pubads.g.doubleclick.net/gampad/clk?id=48897031&iu=/4140/ostg.clktrk
> _______________________________________________
> Snort-users mailing list
> Snort...@lists.sourceforge.net<mailto:Snort...@lists.sourceforge.net>

waldo kitty

unread,
Aug 13, 2013, 2:34:57 PM8/13/13
to
On 8/13/2013 13:55, Avery Rozar wrote:
> I just installed Snort 2.9.5.3. Ran pulled pork with "snort_version=2.9.5.3".
>
> When I try starting snort, it errors out. Below is the error. At first I was thinking maybe I uploaded the wrong rules, but the config looks good.
>
> Initializing rule chains...
> ERROR: /etc/snort/rules/snort.rules(8) Unknown ClassType: protocol-command-decode
> Fatal Error, Quitting..

looks like you do not have a proper classifications.conf file...

cat /etc/classification.config

# $Id$
# The following includes information for prioritizing rules
#
# Each classification includes a shortname, a description, and a default
# priority for that classification.
#
# This allows alerts to be classified and prioritized. You can specify
# what priority each classification has. Any rule can override the default
# priority for that rule.
#
# Here are a few example rules:
#
# alert TCP any any -> any 80 (msg: "EXPLOIT ntpdx overflow";
# dsize: > 128; classtype:attempted-admin; priority:10;
#
# alert TCP any any -> any 25 (msg:"SMTP expn root"; flags:A+; \
# content:"expn root"; nocase; classtype:attempted-recon;)
#
# The first rule will set its type to "attempted-admin" and override
# the default priority for that type to 10.
#
# The second rule set its type to "attempted-recon" and set its
# priority to the default for that type.
#

#
# config classification:shortname,short description,priority
#

config classification: not-suspicious,Not Suspicious Traffic,3
config classification: unknown,Unknown Traffic,3
config classification: bad-unknown,Potentially Bad Traffic, 2
config classification: attempted-recon,Attempted Information Leak,2
config classification: successful-recon-limited,Information Leak,2
config classification: successful-recon-largescale,Large Scale Information Leak,2
config classification: attempted-dos,Attempted Denial of Service,2
config classification: successful-dos,Denial of Service,2
config classification: attempted-user,Attempted User Privilege Gain,1
config classification: unsuccessful-user,Unsuccessful User Privilege Gain,1
config classification: successful-user,Successful User Privilege Gain,1
config classification: attempted-admin,Attempted Administrator Privilege Gain,1
config classification: successful-admin,Successful Administrator Privilege Gain,1


# NEW CLASSIFICATIONS
config classification: rpc-portmap-decode,Decode of an RPC Query,2
config classification: shellcode-detect,Executable Code was Detected,1
config classification: string-detect,A Suspicious String was Detected,3
config classification: suspicious-filename-detect,A Suspicious Filename was
Detected,2
config classification: suspicious-login,An Attempted Login Using a Suspicious
Username was Detected,2
config classification: system-call-detect,A System Call was Detected,2
config classification: tcp-connection,A TCP Connection was Detected,4
config classification: trojan-activity,A Network Trojan was Detected, 1
config classification: unusual-client-port-connection,A Client was Using an
Unusual Port,2
config classification: network-scan,Detection of a Network Scan,3
config classification: denial-of-service,Detection of a Denial of Service Attack,2
config classification: non-standard-protocol,Detection of a Non-Standard
Protocol or Event,2
config classification: protocol-command-decode,Generic Protocol Command Decode,3
config classification: web-application-activity,Access to a Potentially
Vulnerable Web Application,2
config classification: web-application-attack,Web Application Attack,1
config classification: misc-activity,Misc activity,3
config classification: misc-attack,Misc Attack,2
config classification: icmp-event,Generic ICMP event,3
config classification: inappropriate-content,Inappropriate Content was Detected,1
config classification: policy-violation,Potential Corporate Privacy Violation,1
config classification: default-login-attempt,Attempt to Login By a Default
Username and Password,2
config classification: sdf,Sensitive Data was Transmitted Across the Network,2
config classification: file-format,Known malicious file or file based exploit,1
config classification: malware-cnc,Known malware command and control traffic,1
config classification: client-side-exploit,Known client side exploit attempt,1



--
NOTE: No off-list assistance is given without prior approval.
Please keep mailing list traffic on the list unless
private contact is specifically requested and granted.

Y M

unread,
Aug 13, 2013, 2:41:18 PM8/13/13
to
Glad that you solved the issue, good catch. You may want to refer to

http://www.snort.org/vrt/snort-conf-configurations/

For future reference. These are updated continuously when necessary which you may not have in your local tarball.

Thanks.
From: Avery Rozar
Sent: ‎8/‎13/‎2013 9:25 PM
To: Y M; snort...@lists.sourceforge.net
Subject: Re: [Snort-users] Unknown ClassType: protocol-command-decode

All, I found the issue. My classification.config was jacked up, not sure how it happened. I copied a new one from the /src folder I installed everything from.

Thank you,
Avery

From: Y M <sn...@outlook.com<mailto:sn...@outlook.com>>
Date: Tuesday, August 13, 2013 2:12 PM
To: Avery Rozar <Avery...@i-techsupport.com<mailto:Avery...@i-techsupport.com>>, "snort...@lists.sourceforge.net<mailto:snort...@lists.sourceforge.net>" <snort...@lists.sourceforge.net<mailto:snort...@lists.sourceforge.net>>
Subject: RE: [Snort-users] Unknown ClassType: protocol-command-decode

Can you please post the rule that is causing the error? Probably starting at line 8 in your snort.conf. Also post the rule before and the one after.


> From: Avery...@i-techsupport.com<mailto:Avery...@i-techsupport.com>
> To: snort...@lists.sourceforge.net<mailto:snort...@lists.sourceforge.net>
> Date: Tue, 13 Aug 2013 17:55:44 +0000
> Subject: [Snort-users] Unknown ClassType: protocol-command-decode
>
> I just installed Snort 2.9.5.3. Ran pulled pork with "snort_version=2.9.5.3".
>
> When I try starting snort, it errors out. Below is the error. At first I was thinking maybe I uploaded the wrong rules, but the config looks good.
>
> Initializing rule chains...
> ERROR: /etc/snort/rules/snort.rules(8) Unknown ClassType: protocol-command-decode
> Fatal Error, Quitting..
>
> ,,_ -*> Snort! <*-
> o" )~ Version 2.9.5.3 GRE (Build 132)
> '''' By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
> Copyright (C) 1998-2013 Sourcefire, Inc., et al.
> Using libpcap version 1.0.0
> Using PCRE version: 7.8 2008-09-05
> Using ZLIB version: 1.2.3
>
>
>
>
> ------------------------------------------------------------------------------
> Get 100% visibility into Java/.NET code with AppDynamics Lite!
> It's a free troubleshooting tool designed for production.
> Get down to code-level detail for bottlenecks, with <2% overhead.
> Download for free and get started troubleshooting in minutes.
> http://pubads.g.doubleclick.net/gampad/clk?id=48897031&iu=/4140/ostg.clktrk
> _______________________________________________
> Snort-users mailing list

caixote....@gmail.com

unread,
Nov 20, 2014, 8:05:31 PM11/20/14
to
I get that error on Windows XP, and after 8 hours of work,
got an answer: The Reputation Preprocessor affects , the parsing of all snort.rules. JUST DISABLE THE 'Reputation Preprocessor'.

1.Open SNORT.CONF

2.CHANGE

# Reputation preprocessor. For more information see README.reputation
preprocessor reputation: \
memcap 500, \
priority whitelist, \
nested_ip inner, \
whitelist $WHITE_LIST_PATH\white_list.rules, \
blacklist $BLACK_LIST_PATH\black_list.rules

TO

# Reputation preprocessor. For more information see README.reputation
# preprocessor reputation: \
# memcap 500, \
# priority whitelist, \
# nested_ip inner, \
# whitelist $WHITE_LIST_PATH\white_list.rules, \
# blacklist $BLACK_LIST_PATH\black_list.rules
0 new messages