[Snort-devel] snort-1.8-RELEASE: eth0_ADDRESS substitution

Sven Carstens s.carstens at ...578...
Mon Jul 30 10:53:00 EDT 2001

Hi all,

freshly loaded and installed snort-1.8-RELEASE with database support.
Used standard install method with
and everything went really weird.
- logging only some alerts to a file (alert_full)
- logging nothing to portscan.log (spp_portscan)
- only spp_stream4 logging to database

While heavily messing around I got something like that in /var/log/messages:
snort: FATAL ERROR: ERROR /etc/snort/snort-lib (222) => Rule netmask (,eth0:0_ADDRESS) didn't x-late, WTF?
Now I know that the substitution eth0:0_ADDRESS won't work but the real eye-opener
is that my IP-Adress is nowhere near to

Setting the IP-Adresses by hand into the config-file and everything works perfect.

The system:
SuSE 7.1
libpcapn-0.4a6-285 (original SuSE package)

CU Sven

More information about the Snort-devel mailing list