[Snort-devel] Variable names are expanded in threshold.conf comments
steve.sturges at ...402...
Fri Dec 1 10:52:36 EST 2006
The snort parser does not handle comments at the end of line
very well... This is a known issue. Try moving the # IPC$
to the previous line as a comment.
Ian Chard wrote:
> I had this line in my threshold.conf file:
> suppress gen_id 1, sig_id 2466, track by_src, ip 220.127.116.11/24 # IPC$
> ...and snort failed to start:
> ERROR: Undefined variable name: (threshold.conf:90):
> Presumably the '$' is being interpreted as the prefix to a variable
> name, even though it's in a comment. I removed it and snort started
> Apologies if this is already known about.
> - Ian
More information about the Snort-devel