Re: Bug: $eth0_ADDRESS parse error (FIXED?)

[Erek Adams <erek () snort org>]

On Sat, 7 Feb 2004, Tom Barcellona wrote:

> I have been having the same problem that a few people have had in the
> past regarding the $<interface>_ADDRESS error. I had "EXTERNAL_NET =
> !HOME_NET" and HOME_NET =
> [$eth0_ADDRESS,10.0.0.0/24,10.0.1.0/24,10.0.2.0/24]
>
> Problem was I would always get a Snort parse error. I even tried
> removing all the 10.x.x.x networks and leaving $eth0_ADDRESS by itself.
> Still didn't work.
>
> I finally got it to work by putting HOME_NET before EXTERNAL_NET.
> Everything parses fine now, no errors. Does this sound right to
> everyone?

Makes perfect sense.

"Please set my EXTERNAL_NET to NOT <insert random memory garbage here>",
and then set HOME_NET to <something>."

Why do you think that in snort.conf HOME_NET is defined _before_
EXTERNAL_NET?  :)

Cheers!

-----
Erek Adams

 "It looks just like a Telefunken U-47.  You'll love it..."  -- Frank Zappa


-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users