RE: Errors starting Snort...

["Bristol, Gary L." <gbristol () ou edu>]

That would be unless you want to see if you have internal machines
attacking other internal machines. 

-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of Nigel
Houghton
Sent: Tuesday, November 02, 2004 8:53 AM
To: snort-users () lists sourceforge net
Cc: Lorenzo Rossi
Subject: Re: [Snort-users] Errors starting Snort...

On  0, snort-users-request () lists sourceforge net allegedly wrote:

>    2. RE: Errors starting Snort... (M. Shirk)
 
> --__--__--
>
> Message: 2
> From: "M. Shirk" <shirkdog_linux () hotmail com>
> To: snort-users () lists sourceforge net
> Subject: RE: [Snort-users] Errors starting Snort...
> Date: Mon, 01 Nov 2004 12:36:54 -0500
>
> > From: Lorenzo Rossi <condor_rl () libero it>
> > Reply-To: condor_rl () libero it
> > To: snort-users () lists sourceforge net
> > Subject: [Snort-users] Errors starting Snort...
> > Date: Mon, 1 Nov 2004 17:35:19 +0100
> >
> > Nov  1 17:04:10 europa snort: /etc/snort/snort.eth0.conf(357) Unable
to
> > create an IPSet from [any]
>
> Check your HOME_NET and EXTERNAL_NET variables in your
snort.eth0.conf, and 
> make sure they do not say:
>
> EXTERNAL_NET [any]
>
> It should say this:
>
> EXTERNAL_NET any
>
>
> Shirkdog

Actually, you may want to make it:

 var EXTERNAL_NET !$HOME_NET

You will get better results in the long run. Assuming of course that the
HOME_NET variable is *NOT* set to "any".
 
+-----------------------------------------------------------------+
    Nigel Houghton      Research Engineer       Sourcefire Inc.
                  Vulnerability Research Team

 Cat: "Forget red - let's go all the way up to brown alert!"
 Kryten: "There's no such thing as a brown alert sir."
 Cat: "You won't be saying that in a minute!"


-------------------------------------------------------
This SF.Net email is sponsored by:
Sybase ASE Linux Express Edition - download now for FREE
LinuxWorld Reader's Choice Award Winner for best database on Linux.
http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
This SF.Net email is sponsored by:
Sybase ASE Linux Express Edition - download now for FREE
LinuxWorld Reader's Choice Award Winner for best database on Linux.
http://ads.osdn.com/?ad_idU88&alloc_id065&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users