Snort mailing list archives
Re: Rule IP addr (!192.168.1.1) didn't x-late, WTF?
From: HABU Takuya <habu () yk fujitsu co jp>
Date: Wed, 27 Jun 2001 09:14:18 +0900
Oh, you don't need any quotes. (I use Snort 1.7) var HOME_NET 192.168.1.1/32 I suppose these quotes in the conf file may be misleading... On Tue, 26 Jun 2001 18:59:15 -0400 "Jason Lewis" <jlewis () jasonlewis net> wrote:
Quotes.... var HOME_NET "192.168.1.1"/32 Change that to var HOME_NET "192.168.1.1/32" Jason Lewis http://www.packetnexus.com It's not secure "Because they told me it was secure". The people at the other end of the link know less about security than you do. And that's scary. -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net]On Behalf Of Cameron Just Sent: Tuesday, June 26, 2001 6:28 PM To: Snort-users () lists sourceforge net Subject: [Snort-users] Rule IP addr (!192.168.1.1) didn't x-late, WTF? Hi, Anyone know how to fix this problem on a Redhat 6.2 Machine with the latest Snort installed. Here is the /var/log/messages info Jun 26 13:01:51 him snort: Initializing daemon mode Jun 26 13:01:51 him kernel: eth0: Setting promiscuous mode. Jun 26 13:01:51 him kernel: device eth0 entered promiscuous mode Jun 26 13:01:51 him snort: ERROR /etc/snort/base.conf (8) => Rule IP addr (!192.168.1.1) didn't x-late, WTF? Jun 26 13:01:51 him kernel: device eth0 left promiscuous mode Jun 26 13:01:51 him snort: snort startup succeeded. This is the line it is dying on in my snort.conf var HOME_NET "192.168.1.1"/32 I can't find anything in the FAQs and founf this problem on the Mailing lists but there was never any answer...... _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
---------- Takuya Habu mail: habu.takuya () jp fujitsu com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Rule IP addr (!192.168.1.1) didn't x-late, WTF? Cameron Just (Jun 26)
- RE: Rule IP addr (!192.168.1.1) didn't x-late, WTF? Jason Lewis (Jun 26)
- Re: Rule IP addr (!192.168.1.1) didn't x-late, WTF? HABU Takuya (Jun 26)
- RE: Rule IP addr (!192.168.1.1) didn't x-late, WTF? Cameron Just (Jun 27)
- RE: Rule IP addr (!192.168.1.1) didn't x-late, WTF? Jason Lewis (Jun 27)
- RE: Rule IP addr (!192.168.1.1) didn't x-late, WTF? Cameron Just (Jun 27)
- Message not available
- RE: Rule IP addr (!192.168.1.1) didn't x-late, WTF? Cameron Just (Jun 27)
- Re: Rule IP addr (!192.168.1.1) didn't x-late, WTF? Martin Roesch (Jun 27)
- Re: Rule IP addr (!192.168.1.1) didn't x-late, WTF? Phil Wood (Jun 27)
- RE: Rule IP addr (!192.168.1.1) didn't x-late, WTF? Jason Lewis (Jun 26)
- <Possible follow-ups>
- RE: Rule IP addr (!192.168.1.1) didn't x-late, WTF? Johnson, David (Jun 27)