[Snort-users] erek at ...577...

Mark A. Lewis mark at ...1881...
Mon Apr 23 23:43:02 EDT 2001


Date: Mon, 23 Apr 2001 07:32:47 -0700 (PDT)
From: Erek Adams <erek at ...577...>
To: dotslash <dotslash at ...1760...>
cc: Snort <snort-users at lists.sourceforge.net>
Subject: Re: [Snort-users] Couldn't resolve hostname HOME_NET

On Mon, 23 Apr 2001, dotslash wrote:

> grrr.. i d/l'ed snort-1.7 again today and the rules tarball.  unzipped.
> setup to my liking (which is what i have since day 1 which was working).
> then i get this:
>
> Apr 23 15:58:03 snortle snort: 
ERROR /usr/local/snort/rules/exploit.rules
> (4) => Couldn't resolve hostname HOME_NET

[...snip...]

I saw something similar to this when I first setup snort v1.7 . Errored 
out running all the rulesets that were dependent on variables in 
snort.conf such as smpt.rules. Discovered that the fix was in snort.conf 
when specifying your web/smtp/ftp server there should be a space between 
the $ and the IP/name. In your case I would make sure that you are 
expressing the HOME_NET as 192.168.1.0/24 or something similar. It may 
work with a domain name if your DNS is configured properly but I am not 
sure about this. Hope this helps...

Mark
Experience is that marvelous thing that enables you to recognize a 
mistake when you make it again. 
-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net






More information about the Snort-users mailing list