[Snort-users] var HOME_NET under Linux (fwd)

Ciprian Badescu ciprian.badescu at ...9292...
Mon Jun 30 06:19:09 EDT 2003


> ERROR: Undefined variable name: (/etc/snort/snort.eth1.conf:47): eth0_ADDRESS

> eth0      Link encap:Ethernet  HWaddr 00:50:FC:9E:46:44
>           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
>           RX packets:14438274 errors:110 dropped:0 overruns:0 frame:0
>           TX packets:15323465 errors:0 dropped:0 overruns:0 carrier:0
>           collisions:53803 txqueuelen:100
>           RX bytes:3438876581 (3.2 GiB)  TX bytes:3431480714 (3.1 GiB)
>           Interrupt:11 Base address:0x4f00

Using ethx_ADDRESS or such definitions,  you don't need to specify a IP
network, but the network must be configured for that interface, so SNORT
 will find the network address himself.

But I don't know if snort will re-read the interface configuration, if it
is running, and the IP change/reconfiguration occurs.

If you start snort after connecting (or after your interface is
configured and has a IP address) should work.

Ciprian Badescu

> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

More information about the Snort-users mailing list