[Snort-devel] Variable names are expanded in threshold.conf comments

Ian Chard ian.chard at ...2913...
Fri Dec 1 09:50:47 EST 2006


I had this line in my threshold.conf file:

suppress gen_id 1, sig_id 2466, track by_src, ip  # IPC$

...and snort failed to start:

	ERROR: Undefined variable name: (threshold.conf:90):

Presumably the '$' is being interpreted as the prefix to a variable
name, even though it's in a comment.  I removed it and snort started

Apologies if this is already known about.

- Ian

Ian Chard, Senior Unix and Network Admin  |  E: ian.chard at ...2913...
Systems and Electronic Resources Service  |  T:  80587 / (01865) 280587
Oxford University Library Services        |  F:          (01865) 242287

More information about the Snort-devel mailing list