Re: Snort 2.4.4 on CentOS 4.3 won't listen on ppp0

[Joel Esler <joel.esler () sourcefire com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

John,

Snort never starts, see the Fatal error?
> ERROR: Undefined variable name: (/etc/snort/snort.conf:33):  
> ppp0_ADDRESS
> Fatal Error, Quitting..

What do you have on line 33?

Joel




On Apr 21, 2006, at 12:35 AM, John Messinger wrote:

> Followed the installation guide from the Docs section (Snort,  
> Apache, SSL, PHP, MySQL, and BASE Install on CentOS 4, RHEL 4 or  
> Fedora Core), with the exception that I installed the official  
> Snort 2.4.4 RHEL4 rpms (snort + snort-mysql).
>
> Snort seems to start OK (no errors given anywhere, and syslog shows  
> a good startup), but no sensors are listed in BASE - nada.
>
> Running snort -c /etc/snort/snort.conf gives the following output:
>
> ***
> *** interface device lookup found: eth0
> ***
> Running in IDS mode
>
> Initializing Network Interface eth0
>
> --== Initializing Snort ==--
> Initializing Output Plugins!
> Decoding Ethernet on interface eth0
> Initializing Preprocessors!
> Initializing Plug-ins!
> Parsing Rules file /etc/snort/snort.conf
>
> +++++++++++++++++++++++++++++++++++++++++++++++++++
> Initializing rule chains...
> ERROR: Undefined variable name: (/etc/snort/snort.conf:33):  
> ppp0_ADDRESS
> Fatal Error, Quitting..
>
> My snort.conf file defines HOME_NET as $ppp0_ADDRESS. I have  
> modified /etc/sysconfig/snort so that the INTERFACE variable points  
> to ppp0, and also the /etc/rc.d/init.d/snortd script.
>
> As far as I can tell, snort should be getting called with the -i  
> ppp0 option, but it is still trying to listen on the eth0 interface.
>
> My network setup is a DSL modem connected to eth1, with eth0 being  
> the interface to the private LAN. Yes, the IP address from my ISP  
> is dynamic, not fixed.
>
> If more information is required, please let me know. Appreciate any  
> suggestions as to getting this to work.
>
> Regards,
>
> John
>
>
> -------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services,  
> security?
> Get stuff done quickly with pre-integrated technology to make your  
> job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache  
> Geronimo
> http://sel.as-us.falkag.net/sel? 
> cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)

iD8DBQFESMb9KbCSyXHckt4RAgYjAJ9hIOmzhBQTM4ubII0No8x5dPnQ2ACfYxGV
K5i4SlGKMqNt9HscDS5gWGY=
=lWAV
-----END PGP SIGNATURE-----


-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users