Re: Brackets around 1st varible in snort.conf

[John Sage <jsage () finchhaven com>]

Randy:

Quick thought:

Randy wrote:

> Just upgraded to 1.8.1 RELEASE from 1.7, on RedHat 7.1 (libpcap w/includes
> installed via src.rpm --recompile).


<snip>

> Multi CIDR sub-nets in HOME_NET worked fine in 1.7  Multi CIDR sub-nets work in
> all other variables in 1.8.1, except the 1st listed in snort.conf
>
> Only if I use a single non-bracketed value for the 1st variable, will snort run.


If that's the case, put another variable that *has* only a single value 
first, and then put HOME_VAR with its multiple bracketed values after...

It may be just a hack, but if it works...


- John

--
John Sage
FinchHaven, Vashon Island, WA, USA
http://www.finchhaven.com/
mailto:jsage () finchhaven com
"The web is so, like, five minutes ago..."


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users