RE: Help

["John Berkers" <berjo () ozemail com au>]

Also,

Don't forget to enclose the whole lot in []'s eg:

var HOME_NET [x.x.128.0/17,x.x.0.0/17,x.x.0.0/17,x.x.160.0/19]

var DNS_SERVERS [x.x.x.203/32,x.x.128.204/32,x.x.160.10/32]

Otherwise Snort will not like them.

Regards,
John Berkers
berjo () ozemail com au


-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net]On Behalf Of John Sage
Sent: Monday, 6 August 2001 5:01
To: Advanced Hosting UNIX Admin Daniel Fairchild
Cc: snort-users () lists sourceforge net
Subject: Re: [Snort-users] Help


Advanced Hosting UNIX Admin Daniel Fairchild wrote:

> I am setting up snort 1.8 for the first time with database mysql logging
and
> snort does not work.
>
> Here is my config with ips change :)
> ---------- MY CONFIG FILE --------------
> # Start snort with:
> #     /usr/local/bin/snort -c /etc/snort.d/snort.conf -l /tcplog/snort -D -i
eth1
> -q
> #
> # Network variables.
> var HOME_NET x.x.128.0/17 x.x.0.0/17 x.x.0.0/17 x.x.160.0/19
> x.x.64.0/18
> var EXTERNAL_NET any


Directly from the text of the snort.conf provided with the 1.8.1-beta4 I
have:

"MAKE SURE YOU DONT PLACE ANY SPACES IN YOUR LIST"

Am I seeing spaces in your list? Separate IP's are to separated by
commas, I believe...


> # Servers
> var SMTP $HOME_NET
> var HTTP_SERVERS $HOME_NET
>
> # Dns servers.
> var DNS_SERVERS x.x.x.203/32 x.x.128.204/32 x.x.160.10/32
> x.x.162.106/32


Ditto, presumably...


<snip>


- John

--
John Sage
FinchHaven, Vashon Island, WA, USA
http://www.finchhaven.com/
mailto:jsage () finchhaven com
"The web is so, like, five minutes ago..."


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users