Snort mailing list archives
Re: Snort + NIDS + SLES10 problem
From: Todd Wease <twease () sourcefire com>
Date: Tue, 13 Feb 2007 09:28:16 -0500
maged shaker wrote:
Dear all I was installed SuSE Linux Enterprise Server 10 on HP pro370 , with one Ethernet then i configured snort-2.4.4-10.4 that are coming with SLES10 distribution with snort file under /etc/sysconfig/snort ,and insert the interface in this file as the following : SNORT_INTERFACE="eth0" then start the snort daemon under /etc/init.d/snort , and it start successfully , so snort was started to act as "HIDS" Host Intrusion detection system , but the *problem* with the *next* *scenario* when enable snort as "NIDS" Network Intrusion detection system SLES10 has two network address , one configured with IP to allow administrator to monitoring and view the "Base" Basic Analysis and Security Engine ,and the other interface is not configured to use for sniffing the traffic and configured with snort , and it attached to span port in the switch but when insert the other network address in /etc/sysconfig/snort as the following : SNORT_INTERFACE="eth1 "and start snort it failed when start and tell me in /var/log/message : Parsing Rules file /etc/snort/snort.conf Feb 10 05:59:42 linux1 snort[9023]: FATAL ERROR: Undefined variable name: (/etc/snort/snort.conf:44): eth1_ADDRESS please give me advice for this issue and how to solve it Thanks NSM-man ------------------------------------------------------------------------
Sounds like your config file is not defining eth1_ADDRESS before using it (maybe because that interface doesn't have an ip address and so SUSE doesn't define it - I'm guessing SUSE is mucking with the config file based on what you put in /etc/sysconfig/snort). Can you please post your config file (/etc/snort/snort.conf), /etc/sysconfig/snort and the SUSE init script? Thanks Todd ------------------------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier. Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort + NIDS + SLES10 problem maged shaker (Feb 13)
- Re: Snort + NIDS + SLES10 problem Todd Wease (Feb 13)
- Re: Snort + NIDS + SLES10 problem maged shaker (Feb 13)
- Re: Snort + NIDS + SLES10 problem Todd Wease (Feb 13)
- Re: Snort + NIDS + SLES10 problem maged shaker (Feb 13)
- Re: Snort + NIDS + SLES10 problem Todd Wease (Feb 13)