Re: snort.conf doesn't recognize internal address

[David Lambert <dave () demo legallock com>]

Thanks, the problem was that I was not running on that interface, all is 
fixed now. I am now running with the command line:

./snort  -d -i eth1 -c snort.conf

Dave.


On Monday 03 December 2001 11:00 am, Guillaume wrote:
> En réponse à David Lambert <dave () demo legallock com>:
> > originally:
> >     var HOME_NET $eth1_ADDRESS
> > later :
> >     var HOME_NET eth1_ADDRESS
> > Dave.
>
> Well, I re-read distrib. files and found that :
>
> <extract>
> #  variable <intname>_ADDRESS will be intialised to IP address/mask of the
> # network which is configured on interface. Please note that snort has to
> be # running on this interface.
> #
>
> var MY_NET $eth0_ADDRESS
> </extract>
>
>
> First remark : there is a '$' before the variable's name.
> Second thought : how do you run snort ? Did you try to run it by specifying
> the interface with the -i option ? (something like : snort -i eth1 .... )
>
> Best regards,
>
> Guillaume
>
> ***********************************
> Sent with HORDE/IMP (www.horde.org)

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users