[Snort-users] Error in stock 2.2rc1 snort.conf file

Jeremy Hewlett jh at ...1935...
Wed Aug 4 12:57:11 EDT 2004

On Tue, Aug 03, Bill Warren wrote:
> I am testing using it with
> /usr/local/bin/snort -c /etc/snort/etc/snort.conf -T
> and I get
> /etc/snort/etc/snort.conf(506) Unable to create an IPSet from [HOME_NET]
> At line 506 is
> include classification.config

Flow-portscan has many directives that are broken up into single lines
to make it easy to read. Each line is followed by a "\" to indicate
"this is not the end of options, move on to the next line." Thus, the
last line will not have a "\"

Here's my guess. You have some of these flow-portscan lines
uncommented. The last line you have uncommented for flow-portscan
contains a backslash... follow this down through other comments and
whatnot... the next directive is: classification.config. This is
confusing flow-portscan. 

I can reproduce your problem with the above scenario.

More information about the Snort-users mailing list