[Snort-users] Snort Snarf Error

James Hoagland hoagland at ...47...
Fri Apr 13 15:16:12 EDT 2001

At 4:52 PM -0700 4/12/01, Caruso, Ken wrote:
>	First off thanks for all the info regarding the Sniffing on Switched
>network post yesterday, I am in the proccess of planning my dog and pony
>show for person I mentioned and provide him with his password.
>	But the real reason I am sending this email is becuase I have been
>playing around with SnortSnarf and I seem to be getting an error message in
>SnortSnarf.pl, here it is:
>	Use of uninitialized value in substitution (s///) at
>/usr/local/libdata/perl5/site_perl/SnortSnarf/SnortRules.pm line 33.
>	It looks like its the line refering to the rules_file or rules_dir.
>But I dont have the foggiest as what to do next.

Actually this is just an warning message, so SnortSnarf should have 
completed its execution fine (unless the warning is pointing out 
something significant).

Addressing the warning message, what is your snortsnarf.pl command line?

Incidentally, I have fixed the warning messages that people are 
getting when they do not use -rulesfile.  This will be in the the new 
release that I have planned for tomorrow (Saturday).

Most of the warning messages people get from SnortSnarf are produced 
by Perl since I have '-w' on the first line of snortsnarf.pl.  I have 
that to try to find bugs and errors in the command line or in the 
input files.  However, if people want to remove those warning 
messages, they can edit out the '-w'.

Hang in there while we find these few bugs in modularized SnortSnarf.

Kind regards,

|*   Jim Hoagland, Associate Researcher, Silicon Defense    *|
|*               hoagland at ...47...                *|
|*              http://www.silicondefense.com/              *|
|*      Silicon Defense - Technical Support for Snort       *|
|*  Voice: (530) 756-7317              Fax: (530) 756-7297  *|

More information about the Snort-users mailing list