Re: very odd !

[Matt Kettler <mkettler () evi-inc com>]

David Naylor wrote:
> I have recently moved my Snorting from Windows to Linux and while setting up Snort I noticed a very strange issue.  
> When I kick off the IDS, it doesn't seem to read the Snort.conf file.  I have even tried removing the file from the 
> computer and it still boots up just fine.  How then am I to make changes to the configuration??  Is there another 
> file used with the Linux version?  Do I need to recompile every time I change the file?

On *nix, snort does still need a snort.conf file. It does not get compiled in.

However, what snort.conf are you changing/removing? Are you sure you have the
RIGHT snort.conf file?

By default, snort will look for either /etc/snort.conf or ./snort.conf. If
you're working with the one in ./ snort might be ignoring you because it's
reading the one out of /etc. (Most normal, unix-minded sites will have the
config file in /etc or the /etc of their chrooted environment.)


One way to clarify this is to use the -c parameter to snort and tell it what
conf file to use.


-------------------------------------------------------
This SF.Net email is sponsored by Yahoo.
Introducing Yahoo! Search Developer Network - Create apps using Yahoo!
Search APIs Find out how you can build Yahoo! directly into your own
Applications - visit http://developer.yahoo.net/?fr=offad-ysdn-ostg-q22005
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users