<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="GENERATOR" content="MSHTML 8.00.7600.16466">
</head>
<body bgcolor="#ffffff" ocsi="x">
<div dir="ltr"><font color="#000000" size="2" face="Tahoma">I am happy to hear you had success and that someone besides myself is getting use out of the work.</font></div>
<div dir="ltr"><font size="2" face="tahoma"></font> </div>
<div>
<div><font size="2" face="Tahoma">
<div>
<p style="MARGIN-BOTTOM: 12pt" class="MsoNormal"><span style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: black; FONT-SIZE: 10pt">Best Regards,<br>
<br>
<b>Mark P. Clift</b></span></font> </p>
<hr tabindex="-1">
<font size="2" face="Tahoma"><b>From:</b> snortsam-discussion-bounces@snortsam.net [snortsam-discussion-bounces@snortsam.net] On Behalf Of John Liss [john@lissproductions.com]<br>
<b>Sent:</b> Sunday, December 13, 2009 2:38 PM<br>
<b>To:</b> snortsam-discussion@snortsam.net<br>
<b>Subject:</b> Re: [Snortsam-discussion] MS ISA 2006 functionality<br>
</font><br>
<p></p>
</div>
</div>
</div>
<div></div>
<div><font face="Calibri">Gang,<br>
<br>
After loading VS6, I was able to compile both snort + mssql and snortsam + isa2006.<br>
Appears functional and adding IP's to the block computer lists.<br>
<br>
Thanks Mark the the nudge in the right direction : ]<br>
<br>
Conclusion, VS2008's upgrade process (or just change in functionality) breaks the project.<br>
<br>
-John<br>
</font><br>
<span>
<div style="BORDER-LEFT: blue solid; PADDING-LEFT: 0.5em; FONT-FAMILY: Tahoma; MARGIN-BOTTOM: -2.4em; FONT-SIZE: 10pt">
<hr>
<div><b>From:</b> Mark Clift <a class="moz-txt-link-rfc2396E" href="mailto:mark.clift@usitek.com">
<mark.clift@usitek.com></a></div>
<div><b>To:</b> <a class="moz-txt-link-rfc2396E" href="mailto:john@lissproductions.com">
"john@lissproductions.com"</a> <a class="moz-txt-link-rfc2396E" href="mailto:john@lissproductions.com">
<john@lissproductions.com></a>, <a class="moz-txt-link-rfc2396E" href="mailto:snortsam-discussion@snortsam.net">
"snortsam-discussion@snortsam.net"</a> <a class="moz-txt-link-rfc2396E" href="mailto:snortsam-discussion@snortsam.net">
<snortsam-discussion@snortsam.net></a></div>
<div><b>Sent:</b> Saturday, December 12, 2009 3:05:17 PM</div>
<div><b>Subject:</b> [Snortsam-discussion] MS ISA 2006 functionality<br>
<br>
</div>
</div>
</span><br>
<blockquote type="cite">
<p><font size="2" face="Tahoma"><span style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: black; FONT-SIZE: 10pt">I have had the best results using VC6 when working with this project. Moving to that will probably solve most if not all of your problems. I was just
about to upgrade my coding PC but I think I will take a few minutes to see if I can get anything to compile before doing that. I has been a couple of years since I worked on this project.</span></font><font size="2" face="Tahoma"><span style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: black; FONT-SIZE: 10pt"></span></font></p>
<div dir="ltr"><font size="2" face="Tahoma"><br>
Best Regards,<br>
<br>
<b>Mark P. Clift</b></font></div>
<div dir="ltr">
<hr tabindex="-1">
</div>
<div dir="ltr"><font size="2" face="Tahoma"><b>From:</b> <a class="moz-txt-link-abbreviated" href="mailto:snortsam-discussion-bounces@snortsam.net">
snortsam-discussion-bounces@snortsam.net</a> [<a class="moz-txt-link-abbreviated" href="mailto:snortsam-discussion-bounces@snortsam.net">snortsam-discussion-bounces@snortsam.net</a>] On Behalf Of John Liss [<a class="moz-txt-link-abbreviated" href="mailto:john@lissproductions.com">john@lissproductions.com</a>]<br>
<b>Sent:</b> Saturday, December 12, 2009 3:11 PM<br>
<b>To:</b> <a class="moz-txt-link-abbreviated" href="mailto:snortsam-discussion@snortsam.net">
snortsam-discussion@snortsam.net</a><br>
<b>Subject:</b> Re: [Snortsam-discussion] MS ISA 2006 functionality<br>
</font><br>
</div>
<div><font face="Calibri">Hey Mark,<br>
<br>
I'm having problems compiling snort to talk to snortsam. (I haven't even gotten to compile snortsam yet)<br>
<br>
What I have:<br>
<br>
Snort 2.8.5.1 + mssql support on XPSp3 Win32 with Visual Studio 2008. (I'm about to load VS 6 to see if it fixes some weird upgrade issues that may be happening when VS2008 upgrades the VS6 project files.)<br>
<br>
Taking the 2.8.5.1 snort code base code and compiling it with out the snortsam-2.8.5.diff<br>
<br>
The SQLServer Release project seems build ok after I resolved some minor issues like missing the sql 2000 ntwdblib.lib, dll and cygwin stuff.<br>
<br>
</font><font face="Calibri">During the build there are lots of warnings about strcpy and fopen but it builds.<br>
<br>
</font><font face="Calibri">What is weird, is that the file sizes are way off. (I would suspect a tad difference in size but not huge amounts)<br>
Almost like it is missing some class or something.<br>
<br>
12/12/2009 01:03 PM 905,216 snort.exe <- Mine<br>
10/21/2009 01:18 PM 913,408 snortworking.exe <- downloaded from snort.org in the win32 2.8.5.1 package.<br>
<br>
When mine runs it tosses an exception error.<br>
Event Type: Error<br>
Event Source: Application Error<br>
Event Category: None<br>
Event ID: 1000<br>
Date: 12/12/2009<br>
Time: 12:55:17 PM<br>
User: N/A<br>
Computer: <br>
Description:<br>
Faulting application snort.exe, version 0.0.0.0, faulting module snort.exe, version 0.0.0.0, fault address 0x0008838a.<br>
<br>
For more information, see Help and Support Center at <a class="moz-txt-link-freetext" href="http://go.microsoft.com/fwlink/events.asp" target="_blank">
http://go.microsoft.com/fwlink/events.asp</a>.<br>
Data:<br>
0000: 41 70 70 6c 69 63 61 74 Applicat<br>
0008: 69 6f 6e 20 46 61 69 6c ion Fail<br>
0010: 75 72 65 20 20 73 6e 6f ure sno<br>
0018: 72 74 2e 65 78 65 20 30 rt.exe 0<br>
0020: 2e 30 2e 30 2e 30 20 69 .0.0.0 i<br>
0028: 6e 20 73 6e 6f 72 74 2e n snort.<br>
0030: 65 78 65 20 30 2e 30 2e exe 0.0.<br>
0038: 30 2e 30 20 61 74 20 6f 0.0 at o<br>
0040: 66 66 73 65 74 20 30 30 ffset 00<br>
0048: 30 38 38 33 38 61 0d 0a 08838a..<br>
<br>
<br>
I am clueless of where to even begin to fix this error.<br>
<br>
Is there any articles or howto's with VS2008/2005 to compile snort?<br>
<br>
Or better yet is there a win32 flavor of snort 2.8.5.x out there with mssql support and snortsam support. I haven't been able to find one.<br>
-John<br>
</font><br>
<span>
<div style="BORDER-LEFT: blue solid; PADDING-LEFT: 0.5em; FONT-FAMILY: Tahoma; MARGIN-BOTTOM: -2.4em; FONT-SIZE: 10pt">
<hr>
<div><b>From:</b> Mark Clift <a class="moz-txt-link-rfc2396E" href="mailto:mark.clift@usitek.com">
<mark.clift@usitek.com></a></div>
<div><b>To:</b> <a class="moz-txt-link-rfc2396E" href="mailto:snortsam-discussion@snortsam.net">
"snortsam-discussion@snortsam.net"</a> <a class="moz-txt-link-rfc2396E" href="mailto:snortsam-discussion@snortsam.net">
<snortsam-discussion@snortsam.net></a></div>
<div><b>Sent:</b> Saturday, December 12, 2009 12:20:33 PM</div>
<div><b>Subject:</b> [Snortsam-discussion] MS ISA 2006 functionality<br>
<br>
</div>
</div>
</span><br>
<blockquote type="cite"><style title="owaParaStyle"><!--P {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
--></style>
<div dir="ltr"><font color="#000000" size="2" face="Tahoma">Attached is a readme I wrote sometime back.</font></div>
<div dir="ltr"> </div>
<div dir="ltr"><font size="2" face="tahoma">What specific issues are you having compiling? The is a precompiled binary on the snortsam.net site for 2.8.5. The ISA binary there is compiled for ISA2004 and probably used the dll from that version. Though untested
it may still function for 2006 as the plugin uses the ISA management interface which is largely unchanged between the versions of ISA 2004 and 2006 otherwise you will need to compile snortsam with the dll from the version and patch level that matches the ISA
version you are using.</font></div>
<div>
<div><font size="2" face="Tahoma">
<div>
<p style="MARGIN-BOTTOM: 12pt" class="MsoNormal"><span style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: black; FONT-SIZE: 10pt"><br>
Best Regards,<br>
<br>
<b>Mark P. Clift</b></span></p>
</div>
</font></div>
</div>
<div style="DIRECTION: ltr" id="divRpF422600">
<hr tabindex="-1">
<font size="2" face="Tahoma"><b>From:</b> <a class="moz-txt-link-abbreviated" href="mailto:snortsam-discussion-bounces@snortsam.net">
snortsam-discussion-bounces@snortsam.net</a> [<a class="moz-txt-link-abbreviated" href="mailto:snortsam-discussion-bounces@snortsam.net">snortsam-discussion-bounces@snortsam.net</a>] On Behalf Of John Liss [<a class="moz-txt-link-abbreviated" href="mailto:john@lissproductions.com">john@lissproductions.com</a>]<br>
<b>Sent:</b> Saturday, December 12, 2009 1:36 AM<br>
<b>To:</b> <a class="moz-txt-link-abbreviated" href="mailto:snortsam-discussion@snortsam.net">
snortsam-discussion@snortsam.net</a><br>
<b>Subject:</b> [Snortsam-discussion] MS ISA 2006 functionality<br>
</font><br>
</div>
<div>Hey all!<br>
I am trying to figure out how to compile snort to support snortsam, as well as getting it to work with ISA 2006.<br>
Any how to's to point me in the general direction would be appreciated!<br>
<br>
-John<b><br>
</b></div>
<br>
<hr>
<font color="black" size="2" face="Arial">DISCLAIMER:<br>
This transmission may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information
contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Internet communications
cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions.<br>
</font>
<pre><fieldset class="mimeAttachmentHeader"></fieldset>
_______________________________________________
Snortsam-discussion mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Snortsam-discussion@snortsam.net">Snortsam-discussion@snortsam.net</a><a class="moz-txt-link-freetext" href="http://lists.snortsam.net/mailman/listinfo/snortsam-discussion" target="_blank">http</a><a class="moz-txt-link-freetext" href="http://lists.snortsam.net/mailman/listinfo/snortsam-discussion" target="_blank">://lists.snortsam.net/mailman/listinfo/snortsam-discussion</a>
</pre>
</blockquote>
</div>
<br>
<hr>
<font color="black" size="2" face="Arial">DISCLAIMER:<br>
This transmission may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information
contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Internet communications
cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions.<br>
</font></blockquote>
</div>
<br>
<hr>
<font face="Arial" color="Black" size="2">DISCLAIMER:<br>
This transmission may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information
contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Internet communications
cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions.<br>
</font>
</body>
</html>