[Snort-devel] Variable names are expanded in threshold.conf comments

Ian Chard ian.chard at ...2913...
Fri Dec 1 09:50:47 EST 2006


Hi,

I had this line in my threshold.conf file:

suppress gen_id 1, sig_id 2466, track by_src, ip 163.1.62.0/24  # IPC$
access

...and snort failed to start:

	ERROR: Undefined variable name: (threshold.conf:90):

Presumably the '$' is being interpreted as the prefix to a variable
name, even though it's in a comment.  I removed it and snort started
successfully.

Apologies if this is already known about.

Cheers
- Ian

-- 
Ian Chard, Senior Unix and Network Admin  |  E: ian.chard at ...2913...
Systems and Electronic Resources Service  |  T:  80587 / (01865) 280587
Oxford University Library Services        |  F:          (01865) 242287




More information about the Snort-devel mailing list