[Snort-users] Brackets around 1st varible in snort.conf

John Sage jsage at ...2022...
Sun Sep 2 15:36:01 EDT 2001


Quick thought:

Randy wrote:

> Just upgraded to 1.8.1 RELEASE from 1.7, on RedHat 7.1 (libpcap w/includes
> installed via src.rpm --recompile).


> Multi CIDR sub-nets in HOME_NET worked fine in 1.7  Multi CIDR sub-nets work in
> all other variables in 1.8.1, except the 1st listed in snort.conf
> Only if I use a single non-bracketed value for the 1st variable, will snort run.

If that's the case, put another variable that *has* only a single value 
first, and then put HOME_VAR with its multiple bracketed values after...

It may be just a hack, but if it works...

- John

John Sage
FinchHaven, Vashon Island, WA, USA
mailto:jsage at ...2022...
"The web is so, like, five minutes ago..."

More information about the Snort-users mailing list