Testing the Snort configuration

[KeRit]

I'm installing WinSnort on a Windows Server 2012 R2 computer following your guide, but I got a error message at testing the configuration.

 

After I'd changed the Snort.conf file, I'm getting the error message you can see in the attached file WinIDS_Config_Error.JPG.

I checked the Snort.conf file, but I cann't find the error. Line 326 don't have a trailing white space.

 

 

Do you know what is causing the error?

snort.conf

[Morpheus]

Try this config file.

snort.conf

[KeRit]

Thank you for the quick response!

With the new conf file I'm getting the same error!

 

[Morpheus]

It appears that Sorcefire has added some items that will need additional configuring in the OS. For now edit the snort.conf to the below:

Original Line(s):

    decompress_swf { deflate lzma } \

Change to:

#   decompress_swf { deflate lzma } \

The decompression fault for SWF files requires an additional library (LZMA). I have made a request to the development team to look into this problem, and they are looking into it.

[KeRit]

I have done Configuring IIS for PHP, and the Windows Intrusion Detection Systems security console again but it didn't help. I missed the file fixit.vbs. Which packet contains this file?