[Snort-users] Brackets around 1st varible in snort.conf

John Sage jsage at ...2022...
Sun Sep 2 15:36:01 EDT 2001


Randy:

Quick thought:

Randy wrote:

> Just upgraded to 1.8.1 RELEASE from 1.7, on RedHat 7.1 (libpcap w/includes
> installed via src.rpm --recompile).


<snip>

> Multi CIDR sub-nets in HOME_NET worked fine in 1.7  Multi CIDR sub-nets work in
> all other variables in 1.8.1, except the 1st listed in snort.conf
> 
> Only if I use a single non-bracketed value for the 1st variable, will snort run.


If that's the case, put another variable that *has* only a single value 
first, and then put HOME_VAR with its multiple bracketed values after...

It may be just a hack, but if it works...


- John

-- 
John Sage
FinchHaven, Vashon Island, WA, USA
http://www.finchhaven.com/
mailto:jsage at ...2022...
"The web is so, like, five minutes ago..."





More information about the Snort-users mailing list