Snort mailing list archives
Question re: FAQ 3.5....
From: Bob Hillegas <bobhillegas () pdq net>
Date: Fri, 17 Aug 2001 07:24:53 -0500 (CDT)
I have a question about a section of the FAQ. ---- snip ---- 3.5 --faq-- --snort-- --faq-- --snort-- --faq-- --snort-- --faq-- Q: IP address is assigned dynamically to my interface, can I use snort with it? A: Yes.With snort 1.7 and later, <interface>_ADDRESS variable is available. The value of this variable will be always set to IP address/Netmask of the interface which you run snort at. if interface goes down and up again (and an IP address is reassigned) you will have to restart snort. For earlier versions of snort numerous scripts to achieve the same result are available. ---- snip ---- I tried to access this by the following: var HOME_NET ppp0_ADDRESS var EXTERNAL_NET !$HOME_NET This exits with an undefined variable error. ---- snip ---- ERROR /etc/snort/snort.conf (228) => Couldn't resolve hostname ppp0_ADDRESS Fatal Error, Quitting.. ---- snip ---- Obviously I am misinterpretting the '<intrerface>_ADDRESS variable is available'. How is this value accessed? Thanks -- ------------------------------------------------- Bob Hillegas <bobhillegas () pdq net> 281.546.9311 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Question re: FAQ 3.5.... Bob Hillegas (Aug 17)
- Re: Question re: FAQ 3.5.... Mike Baptiste (Aug 17)
- Re: Question re: FAQ 3.5.... Bob Hillegas (Aug 17)
- Re: Question re: FAQ 3.5.... Mike Baptiste (Aug 17)