On 31.03.2008 08:35, Lixin Zou wrote:
> After checking the log file, I found the error message "nfprofile failed:".
> I made two channel for this profile,and both channel have the same
> filter. In the filter,there are more than 1500 IP. the filter is such as
> "src ip 10.5.24.10 <http://10.5.24.10> or src ip 172.16.1.9
> <http://172.16.1.9> or ...".
> I think the filter is the cause of the problem,because I try to change
> the filter file to make the IP number be less than 1500, and restart the
> nfsen,then the nfsen can work normally. I found that the nfsen can work
> normally if the filter's IP number is less than 1500. but I don't know
> how to fix it.
>
> I use nfsen 1.3b-20070824 + nfdump 1.5.6 on FreeBSD, and I have added
> compile options "--enable-nfprofile"
>
> Any suggestions greatly appreciated!
There is a length restriction in ArgDecode() in Nfcomm.pm, but the error
message
doesn't look like it.
If you set the loglevel to debug, NfSen should give you the command that failed
(something starting with "System was: ") immediately after the error message.
If you post that, it'll be a lot easier to help you.
But generally you should update to the latest versions of both NfSen and
Nfdump.
Peter is continuously fixing bugs. :-)
Regards -- Till
--
Dipl.-Inform. Till Dörges [EMAIL PROTECTED]
Senior Researcher Phone: +49 (0)700 / PRESECURE
PRESECURE Consulting GmbH, Münster AG Münster, HRB 6581
Geschäftsführer/Managing Director Dr. Klaus-Peter Kossakowski
CarmentiS - Early Warning Expertise
http://www.carmentis.org
-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
