[Snort-users] $<ifname>_ADDRESS Refresh

Fyodor fygrave at ...121...
Sun Jan 21 17:27:11 EST 2001

On Sun, Jan 21, 2001 at 01:53:32PM -0800, Crist J. Clark wrote:
> Without digging into the code, my suspicion is that the
> '$<ifname>_ADDRESS' variable available in the configuration files for
> Snort 1.7 gets set at startup and never changes. That is, if the
> address of your interface were to change, Snort would not know. One

Yes, because it looks it up at the time when it initialises interface. You'd have to SIGHUP
snort when address gets changed.

> would need to SIGHUP Snort or the like to get the new address of the
> interface to be loaded.
> Just want to make sure before I put a SIGHUP of Snort in my
> dhclient-exit-hooks script.

yep. should be done :)

PGP fingerprint = 56DD 1511 DDDA 56D7 99C7  B288 5CE5 A713 0969 A4D1

More information about the Snort-users mailing list