Snort mailing list archives
Re: Snort 2.4.4 on CentOS 4.3 won't listen on ppp0
From: Joel Esler <joel.esler () sourcefire com>
Date: Fri, 21 Apr 2006 07:50:19 -0400
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 John, Snort never starts, see the Fatal error?
ERROR: Undefined variable name: (/etc/snort/snort.conf:33): ppp0_ADDRESSFatal Error, Quitting..
What do you have on line 33? Joel On Apr 21, 2006, at 12:35 AM, John Messinger wrote:
Followed the installation guide from the Docs section (Snort, Apache, SSL, PHP, MySQL, and BASE Install on CentOS 4, RHEL 4 or Fedora Core), with the exception that I installed the official Snort 2.4.4 RHEL4 rpms (snort + snort-mysql).Snort seems to start OK (no errors given anywhere, and syslog shows a good startup), but no sensors are listed in BASE - nada.Running snort -c /etc/snort/snort.conf gives the following output: *** *** interface device lookup found: eth0 *** Running in IDS mode Initializing Network Interface eth0 --== Initializing Snort ==-- Initializing Output Plugins! Decoding Ethernet on interface eth0 Initializing Preprocessors! Initializing Plug-ins! Parsing Rules file /etc/snort/snort.conf +++++++++++++++++++++++++++++++++++++++++++++++++++ Initializing rule chains...ERROR: Undefined variable name: (/etc/snort/snort.conf:33): ppp0_ADDRESSFatal Error, Quitting..My snort.conf file defines HOME_NET as $ppp0_ADDRESS. I have modified /etc/sysconfig/snort so that the INTERFACE variable points to ppp0, and also the /etc/rc.d/init.d/snortd script.As far as I can tell, snort should be getting called with the -i ppp0 option, but it is still trying to listen on the eth0 interface.My network setup is a DSL modem connected to eth1, with eth0 being the interface to the private LAN. Yes, the IP address from my ISP is dynamic, not fixed.If more information is required, please let me know. Appreciate any suggestions as to getting this to work.Regards, John -------------------------------------------------------Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel? cmd=lnk&kid=120709&bid=263057&dat=121642_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (Darwin) iD8DBQFESMb9KbCSyXHckt4RAgYjAJ9hIOmzhBQTM4ubII0No8x5dPnQ2ACfYxGV K5i4SlGKMqNt9HscDS5gWGY= =lWAV -----END PGP SIGNATURE----- ------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort 2.4.4 on CentOS 4.3 won't listen on ppp0 John Messinger (Apr 20)
- Re: Snort 2.4.4 on CentOS 4.3 won't listen on ppp0 Joel Esler (Apr 21)
- Re: Snort 2.4.4 on CentOS 4.3 won't listen on ppp0 Dirk Geschke (Apr 21)
- Re: Snort 2.4.4 on CentOS 4.3 won't listen on ppp0 John Messinger (Apr 21)
- Re: Snort 2.4.4 on CentOS 4.3 won't listen on ppp0 Patrick S. Harper (Apr 21)
- Re: Snort 2.4.4 on CentOS 4.3 won't listen on ppp0 John Messinger (Apr 21)
- Re: Snort 2.4.4 on CentOS 4.3 won't listen on ppp0 Randal T. Rioux (Apr 21)
- Re: Snort 2.4.4 on CentOS 4.3 won't listen on ppp0 Joel Esler (Apr 21)