Re: FATAL ERROR: /usr/local/etc/snort.conf(45) Unknown rule type: ipvar.

[waldo kitty <wkitty42 () windstream net>]

On 8/15/2011 22:22, Joel Esler wrote:
> Look at the top of the snort.conf file. You should see our recommended compile
> options.

FWIW: that would be the snort.conf distributed with the snort source code OR the 
one included in the sourcefire rules archive... i forget where it is but i had 
to go looking some time back because the snort.conf out installs were using was 
a rather ancient one and (thankfully) it was not being overwritten when rules 
and snort versions were updated... "thankfully" because our customizations would 
have been lost and that would not have been a pretty picture with complaints 
coming from several hundred thousand installs...

> Sent from my iPhone
>
> On Aug 15, 2011, at 21:32, alexus <alexus () gmail com <mailto:alexus () gmail com>>
> wrote:
>
> > Anything specific ?
> >
> > On Aug 15, 2011 8:59 PM, "Joel Esler"
> > <<mailto:jesler () sourcefire com>jesler () sourcefire com
> > <mailto:jesler () sourcefire com>> wrote:
> > > Sounds like you may need to take a look at our recommended compile options
> > at the top of the snort.conf in the etc/ directory.



------------------------------------------------------------------------------
uberSVN's rich system and user administration capabilities and model 
configuration take the hassle out of deploying and managing Subversion and 
the tools developers use with it. Learn more about uberSVN and get a free 
download at:  http://p.sf.net/sfu/wandisco-dev2dev
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please see http://www.snort.org/docs for documentation