Re: FATAL ERROR in bad-traffic.rules

[Xantius <xantius () xantius com>]

*laugh*  Yep.  Seems to be my problem as well.  I didn't have the 
closing ] on the end.  Guess I"ll go back to 2.1.3 and install it 
again.  Thanx for the pointer.  I fixed it later when I was setting up 
2.1.2 but didn't even think that was what was killing 2.1.3.  Now if I 
could just get it to actually recognize scans from nmap and nessus, I'd 
be happy...

--Xantius

Mark E. Donaldson wrote:

> Thanks Joel. Such was the case. As it turned out I did have a space after a
> comma in my list and that was the problem. I guess the parser in 2.1.3 must
> have increased sensitivity. Let's see if we here back from Xantius. 
>
> -----Original Message-----
> From: Joel Esler [mailto:esler () knology net] 
> Sent: Sunday, June 27, 2004 9:09 AM
> To: markee () bandwidthco com
> Cc: 'Xantius'
> Subject: {Spam 0} RE: [Snort-users] FATAL ERROR in bad-traffic.rules
>
> Unterminated IP list sounds like in your snort.conf you have something like
> var HOME_NET [1.1.1.0/24,1.1.2.0/24,]
>
> Like you have it set up to expect another IP list...
>
> J
>
> -----Original Message-----
> From: snort-users-admin () lists sourceforge net
> [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Mark E.
> Donaldson
> Sent: Saturday, June 26, 2004 2:05 PM
> To: 'Xantius'; snort-users () lists sourceforge net
> Subject: RE: [Snort-users] FATAL ERROR in bad-traffic.rules
>
>
>
> -----Original Message-----
> From: snort-users-admin () lists sourceforge net
> [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Xantius
> Sent: Saturday, June 26, 2004 7:58 AM
> To: snort-users () lists sourceforge net
> Subject: [Snort-users] FATAL ERROR in bad-traffic.rules
>
> After hours of trying to get snort installed and working, I feel like I'm
> getting close.  But when I start up snort, it dies with the following
> message.
>
> FATAL ERROR: /etc/snort/rules/bad-traffic.rules(12) => Unterminated IP List
>
> These rules are stock right out of the box.  No idea what the problem is...
> Anyone?
>
> --Xantius
>
> Let me guess. You're trying to install Snort 2.1.3? That's my guess because
> I have run into the same difficulty. Been using snort all the way back since
> day one and have never had any trouble to speak of that I couldn't solve. So
> far no luck on this one. So, I went back to 2.1.2 until I have more time to
> figure it out. Whatever the problem, it seems unique to 2.1.3.
>
>
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by Black Hat Briefings & Training.
> Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital self
> defense, top technical experts, no vendor pitches, unmatched networking
> opportunities. Visit www.blackhat.com
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
> ########################################################
> This message has been scanned for viruses and dangerous content by
> MailScanner, and is believed to be clean.
>
> postmaster () bandwidthco com
> MailScanner at bandwidthco.com is for your absolute protection.
> ########################################################
>
>
>
>  


-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 - 
digital self defense, top technical experts, no vendor pitches, 
unmatched networking opportunities. Visit www.blackhat.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users