Snort mailing list archives
snort.conf doesn't recognize internal address
From: David Lambert <dave () demo legallock com>
Date: Mon, 3 Dec 2001 09:55:03 -0600
I am new to snort, so please forgive me if this is trivial question. If I specify HOME_NET as $eth1_ADDRESS I get the following error on Linux: Parsing Rules file snort.conf +++++++++++++++++++++++++++++++++++++++++++++++++++ Initializing rule chains... [!] ERROR snort.conf (48): Bad value in variable definition! Make sure you don't have a "$" in the var name Fatal Error, Quitting.. The output from my ifconfig is: eth0 Link encap:Ethernet HWaddr 00:10:4B:2C:91:C8 inet addr:207.70.162.2 Bcast:207.70.162.255 Mask:255.255.255.0 UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 RX packets:1028218 errors:0 dropped:0 overruns:0 frame:0 TX packets:1161153 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:541290063 (516.2 Mb) TX bytes:181369655 (172.9 Mb) Interrupt:10 Base address:0xdc00 eth1 Link encap:Ethernet HWaddr 00:01:03:DD:0E:1D inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:732848 errors:0 dropped:0 overruns:0 frame:0 TX packets:1121925 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:142619286 (136.0 Mb) TX bytes:1255335051 (1197.1 Mb) Interrupt:11 Base address:0xe000 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:31942688 errors:0 dropped:0 overruns:0 frame:0 TX packets:31942688 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:1447916537 (1380.8 Mb) TX bytes:1447916537 (1380.8 Mb) Specifying my HOME_NET as var HOME_NET 192.168.1.0/24 works fine, as does eth0_ADDRESS (which of course is not my HOME_NET in this instance). TIA for any help you can give. Dave. _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- snort.conf doesn't recognize internal address David Lambert (Dec 03)
- Re: snort.conf doesn't recognize internal address Guillaume (Dec 03)
- Re: snort.conf doesn't recognize internal address David Lambert (Dec 03)
- Message not available
- Message not available
- Re: snort.conf doesn't recognize internal address David Lambert (Dec 03)
- Message not available
- Re: snort.conf doesn't recognize internal address Guillaume (Dec 03)