[Snort-users] Error message

Matt Kettler mkettler at ...4108...
Fri Aug 16 17:13:03 EDT 2002

Agreed, as Jon said, look at line 46 of your snort.conf

 From looking at the code I'd guess you have a snort.conf with a line 46 
containing a valid rule indented by a space or two.. The snort parser tries 
to split a line up into a series of space delimited substrings, and the 
first one should be the "rule type", but in this case it's gotten a null 

Given the default config having "var HOME_NET" near line 46, you probably 
introduced some misbehaved whitespace around there.

Juliano, if you still don't understand what the problem is, post line 46 of 
your snort.conf and any var's it references, or your whole snort.conf 
(censoring out HOME_NET and EXTERNAL_NET if you deem it important).

At 07:18 PM 8/16/2002 -0400, Jon Quiros wrote:
> > +++++++++++++++++++++++++++++++++++++++++++++++++++
> > Initializing rule chains...
> > ERROR line /usr/local/src/snort/snort.conf (46) => Unknown rule type
> > ((null))
> > Fatal Error, Quitting.. I'd start by checking line 46 of snort.conf,
> > but that's just me.
>This sf.net email is sponsored by: OSDN - Tired of that same old
>cell phone?  Get a new here for FREE!
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>Snort-users list archive:

More information about the Snort-users mailing list