Re: Question re: FAQ 3.5....

[Bob Hillegas <bobhillegas () pdq net>]

Thanks for taking time to point out the obvious. (At least to some of us) %-(

BobH

-- 
-------------------------------------------------
Bob Hillegas
<bobhillegas () pdq net>
281.546.9311

On Fri, 17 Aug 2001, Mike Baptiste wrote:

> Date: Fri, 17 Aug 2001 08:41:55 -0400
> From: Mike Baptiste <mike () baptistefamily net>
> To: Bob Hillegas <bobhillegas () pdq net>
> Cc: snort-users () lists sourceforge net
> Subject: Re: [Snort-users] Question re: FAQ 3.5....
>
> Its a variable - try $ppp0_ADDRESS
>
> Mike
>
> Bob Hillegas wrote:
> > I have a question about a section of the FAQ.
> > ---- snip ----
> > 3.5 --faq-- --snort-- --faq-- --snort-- --faq-- --snort-- --faq--
> > Q: IP address is assigned dynamically to my interface, can I use snort with it?
> >
> > A:  Yes.With snort 1.7 and later, <interface>_ADDRESS variable is available.
> >     The value of this variable will be always set to IP address/Netmask of the
> >     interface which you run snort at. if interface goes down and up again (and
> >     an IP address is reassigned) you will have to restart snort. For earlier
> >     versions of snort numerous scripts to achieve the same result are
> >     available.
> > ---- snip ----
> >
> > I tried to access this by the following:
> > var HOME_NET ppp0_ADDRESS
> > var EXTERNAL_NET !$HOME_NET
> >
> > This exits with an undefined variable error.
> > ---- snip ----
> > ERROR /etc/snort/snort.conf (228) => Couldn't resolve hostname ppp0_ADDRESS
> > Fatal Error, Quitting..
> > ---- snip ----
> >
> > Obviously I am misinterpretting the '<intrerface>_ADDRESS variable is
> > available'. How is this value accessed?
> >
> > Thanks


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users