[Snort-users] snort 1.7 on suse6.3 quitting

jabacha jaba_cha at ...1823...
Sun Jun 3 17:24:38 EDT 2001


*head in hands feeling like a total @ss*

I'm an idiot. I misunderstood the 0/32 0/24 settings. I'm going to
go crawl in a whole somewhere and die now.

My problem is now fixed. I wanted to watch my whole Class C network.

Thanks for all your help.

JC.

On Sat, 02 Jun 2001, you wrote:
> 192.168.0.1/99 is not a valid CIDR notation
> 
> http://false.net/~jg/cidr.html
> 
> What are you trying to accomplish?  How many hosts?  A single host is /32  a
> class C is /24.
> 
> Jason Lewis
> http://www.packetnexus.com
> It's not secure "Because they told me it was secure". The people at the
> other end of the link know less about security than you do. And that's
> scary.
> 
> 
> 
> -----Original Message-----
> From: snort-users-admin at lists.sourceforge.net
> [mailto:snort-users-admin at lists.sourceforge.net]On Behalf Of jabacha
> Sent: Saturday, June 02, 2001 7:16 PM
> To: Paulie
> Cc: snort-users at lists.sourceforge.net
> Subject: Re: [Snort-users] snort 1.7 on suse6.3 quitting
> 
> 
> Paulie,
> 
> Hi.
> 
> I check my snort.conf and below are my current settings.
> 
> var HOME_NET 192.168.0.1/99
> var SMTP 192.168.0.6
> var HTTP_SERVERS 192.168.0.6
> var SQL_SERVERS 192.168.0.6
> 
> I still keep getting the ERROR, and it quits, but I noticed today
> that it didn't quit till after scram ran from my crontab... see..
> log...
> 
> Jun  2 09:20:33 gemini -- MARK --
> Jun  2 09:30:00 gemini /USR/SBIN/CRON[15554]: (root) CMD (cd /usr/local/bin/
> ; sh sc
> ram)
> Jun  2 09:30:03 gemini snort: ERROR: Bad CIDR block [100:100], 1 to 32
> please!
> 
> I now believe that it might be a scram script problem.... what scram
> does is email me the portscan.log once daily and it creates a new
> empty log file...
> 
> JC.
> 
> On Thu, 31 May 2001, you wrote:
> > Greetings,
> >
> > Sounds like you have a bad subnet in one of the config file variables,
> > like $DNS_SERVERS.  Looks like it wants slash notation from /1-/32.
> >
> > Paul
> >
> >
> > On Thu, 31 May 2001, jabacha wrote:
> >
> > > Hi,
> > >
> > > For some reason snort is quiting on me.. it's been running well so
> > > far... but for the last week it's been quiting on it's own... can
> > > anyone tell me what this means?
> > >
> > > May 31 09:30:02 gemini kernel: eth0: Promiscuous mode enabled.
> > > May 31 09:30:02 gemini kernel: device eth0 left promiscuous mode
> > > May 31 09:30:07 gemini snort: ERROR: Bad CIDR block [100:100], 1 to 32
> please!�
> > >
> > > Any help would be appreciated...
> > >
> > > Thanks,
> > >
> > > JC
> > >
> > > _______________________________________________
> > > Snort-users mailing list
> > > Snort-users at lists.sourceforge.net
> > > Go to this URL to change user options or unsubscribe:
> > > http://lists.sourceforge.net/lists/listinfo/snort-users
> > > Snort-users list archive:
> > > http://www.geocrawler.com/redir-sf.php3?list
> > >
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list
> 
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users




More information about the Snort-users mailing list