[Snort-devel] The $<inetname>_ADDRESS variable

Martin Roesch roesch at ...48...
Fri Oct 6 23:20:34 EDT 2000

Jed Pickel wrote:
> I've just been working on the snort-lib file - adding a sample
> configuration for the tcp stream preprocessor and trying to make it
> more user friendly for the 1.7 release.
> I think the $<inetname>_ADDRESS variable is a great step for user
> friendliness; however, I think we could take this one step further and
> additionally set a $DEFAULT_ADDRESS variable for the interface in
> pv.interfaces[0]. This way the snort-lib configuration would work
> without being modified. I mention this mostly because there have been
> a number of posts to snort-users recently that seem to be based on not
> properly setting the HOME_NET variable. Adding this feature could
> eliminate some of the initial confusion around running snort for the
> first time. Thoughts?

Good idea, making it easier on first timers is a great thought.  There are
getting to be enough options in Snort now that it can be fairly daunting to
get up and running.

> One other thought... Do you think it would make sense to rename the
> snort-lib file to snort.conf or something like that?

This is a good idea too.  The reason that the rules file option is "-c" is
that originally (like in 1998) I had the idea that it wasn't just a rules
file, but a full configuration file.  We're to the point now where that's
pretty true. :)


Martin Roesch
roesch at ...48...

More information about the Snort-devel mailing list