RE: Couldn't resolve hostname HOME_NET

["L. Christopher Luther" <CLuther () Xybernaut com>]

Carlos,

A couple of things:  

1) The definition of EXTERNAL_NET should be 'var EXTERNAL_NET !$HOME_NET' --
you missed the $ sign required for macro/variable expansion.

2) Unless you're using multiple networks in the definition of HOME_NET, you
don't need the brackets.  That is, use 'var HOME_NET 10.0.0.66/27' 

I'm betting that it's the mis-defined EXTERNAL_NET that is causing you
problems in your rules file.  


HTH, 

- Christopher 

-----Original Message-----
From: Carlos Felix [mailto:snort () xiata com]
Sent: Tuesday, May 13, 2003 5:32 PM
To: snort-users () lists sourceforge net
Subject: [Snort-users] Couldn't resolve hostname HOME_NET


Hi folks,

I am trying to research my current problem in the list archives but I am
coming up with a

******************************
Not Found
The requested URL /redir-sf.php3 was not found on this server.

Apache/1.3.27 Server at www.geocrawler.com Port 80
******************************

Any time I try to search the archives
(http://www.geocrawler.com/redir-sf.php3?list=snort-users) so I'll ask a
question that likely has already been answered.

I have changed my snort.conf to define my home net as follows

<Snip>
var HOME_NET [10.0.0.66/27]

# Set up the external network addresses as well.
# A good start may be "any"

var EXTERNAL_NET !HOME_NET
</Snip>

but when I try to run snort with the following command line

/usr/sbin/snort -U -d -c /etc/snort/snort.conf -l /var/log/snort -i eth0

I get the following error

ERROR: ERROR /etc/snort/rules/bad-traffic.rules(12): Couldn't resolve
hostname HOME_NET
Fatal Error, Quitting..

Can anyone shed light into this? I am using the latest version of the
snort stable rules & have not modified them.


Carlos


-------------------------------------------------------
Enterprise Linux Forum Conference & Expo, June 4-6, 2003, Santa Clara
The only event dedicated to issues related to Linux enterprise solutions
www.enterpriselinuxforum.com

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
Enterprise Linux Forum Conference & Expo, June 4-6, 2003, Santa Clara
The only event dedicated to issues related to Linux enterprise solutions
www.enterpriselinuxforum.com

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users