[Snort-users] Rule IP addr (!192.168.1.1) didn't x-late, WTF?

HABU Takuya habu at ...1066...
Tue Jun 26 20:14:18 EDT 2001


Oh, you don't need any quotes. (I use Snort 1.7)

var HOME_NET 192.168.1.1/32

I suppose these quotes in the conf file may be misleading...

On Tue, 26 Jun 2001 18:59:15 -0400
"Jason Lewis" <jlewis at ...1831...> wrote:

> Quotes....
> 
> var HOME_NET "192.168.1.1"/32
> 
> Change that to
> 
> var HOME_NET "192.168.1.1/32"
> 
> Jason Lewis
> http://www.packetnexus.com
> It's not secure "Because they told me it was secure".
> The people at the other end of the link know less
> about security than you do. And that's scary.
> 
> 
> 
> -----Original Message-----
> From: snort-users-admin at lists.sourceforge.net
> [mailto:snort-users-admin at lists.sourceforge.net]On Behalf Of Cameron
> Just
> Sent: Tuesday, June 26, 2001 6:28 PM
> To: Snort-users at lists.sourceforge.net
> Subject: [Snort-users] Rule IP addr (!192.168.1.1) didn't x-late, WTF?
> 
> 
> Hi,
> 
> Anyone know how to fix this problem on a Redhat 6.2 Machine with the latest
> Snort installed.
> 
> Here is the /var/log/messages info
> 
> Jun 26 13:01:51 him snort: Initializing daemon mode
> Jun 26 13:01:51 him kernel: eth0: Setting promiscuous mode.
> Jun 26 13:01:51 him kernel: device eth0 entered promiscuous mode
> Jun 26 13:01:51 him snort: ERROR /etc/snort/base.conf (8) => Rule IP addr
> (!192.168.1.1) didn't x-late, WTF?
> Jun 26 13:01:51 him kernel: device eth0 left promiscuous mode
> Jun 26 13:01:51 him snort: snort startup succeeded.
> 
> 
> This is the line it is dying on in my snort.conf
> 
> var HOME_NET "192.168.1.1"/32
> 
> I can't find anything in the FAQs and founf this problem on the Mailing
> lists but there was never any answer......
> 
> 
> 
> 
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

----------
Takuya Habu
mail: habu.takuya at ...1141...





More information about the Snort-users mailing list