[Snort-users] Couldn't resolve hostname HOME_NET

L. Christopher Luther CLuther at ...6333...
Tue May 13 15:18:02 EDT 2003


A couple of things:  

1) The definition of EXTERNAL_NET should be 'var EXTERNAL_NET !$HOME_NET' --
you missed the $ sign required for macro/variable expansion.

2) Unless you're using multiple networks in the definition of HOME_NET, you
don't need the brackets.  That is, use 'var HOME_NET' 

I'm betting that it's the mis-defined EXTERNAL_NET that is causing you
problems in your rules file.  


- Christopher 

-----Original Message-----
From: Carlos Felix [mailto:snort at ...8664...]
Sent: Tuesday, May 13, 2003 5:32 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Couldn't resolve hostname HOME_NET

Hi folks,

I am trying to research my current problem in the list archives but I am
coming up with a

Not Found
The requested URL /redir-sf.php3 was not found on this server.

Apache/1.3.27 Server at www.geocrawler.com Port 80

Any time I try to search the archives
(http://www.geocrawler.com/redir-sf.php3?list=snort-users) so I'll ask a
question that likely has already been answered.

I have changed my snort.conf to define my home net as follows

var HOME_NET []

# Set up the external network addresses as well.
# A good start may be "any"


but when I try to run snort with the following command line

/usr/sbin/snort -U -d -c /etc/snort/snort.conf -l /var/log/snort -i eth0

I get the following error

ERROR: ERROR /etc/snort/rules/bad-traffic.rules(12): Couldn't resolve
hostname HOME_NET
Fatal Error, Quitting..

Can anyone shed light into this? I am using the latest version of the
snort stable rules & have not modified them.


Enterprise Linux Forum Conference & Expo, June 4-6, 2003, Santa Clara
The only event dedicated to issues related to Linux enterprise solutions

Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list