Snort mailing list archives
RE: Help
From: "John Berkers" <berjo () ozemail com au>
Date: Mon, 6 Aug 2001 21:24:46 +1000
Also, Don't forget to enclose the whole lot in []'s eg: var HOME_NET [x.x.128.0/17,x.x.0.0/17,x.x.0.0/17,x.x.160.0/19] var DNS_SERVERS [x.x.x.203/32,x.x.128.204/32,x.x.160.10/32] Otherwise Snort will not like them. Regards, John Berkers berjo () ozemail com au -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net]On Behalf Of John Sage Sent: Monday, 6 August 2001 5:01 To: Advanced Hosting UNIX Admin Daniel Fairchild Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] Help Advanced Hosting UNIX Admin Daniel Fairchild wrote:
I am setting up snort 1.8 for the first time with database mysql logging
and
snort does not work. Here is my config with ips change :) ---------- MY CONFIG FILE -------------- # Start snort with: # /usr/local/bin/snort -c /etc/snort.d/snort.conf -l /tcplog/snort -D -i
eth1
-q # # Network variables. var HOME_NET x.x.128.0/17 x.x.0.0/17 x.x.0.0/17 x.x.160.0/19 x.x.64.0/18 var EXTERNAL_NET any
Directly from the text of the snort.conf provided with the 1.8.1-beta4 I have: "MAKE SURE YOU DONT PLACE ANY SPACES IN YOUR LIST" Am I seeing spaces in your list? Separate IP's are to separated by commas, I believe...
# Servers var SMTP $HOME_NET var HTTP_SERVERS $HOME_NET # Dns servers. var DNS_SERVERS x.x.x.203/32 x.x.128.204/32 x.x.160.10/32 x.x.162.106/32
Ditto, presumably... <snip> - John -- John Sage FinchHaven, Vashon Island, WA, USA http://www.finchhaven.com/ mailto:jsage () finchhaven com "The web is so, like, five minutes ago..." _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users