[Snort-users] Fatal error when starting snort on the sensor

sekure sekure at ...11827...
Mon Sep 20 06:48:07 EDT 2004


The duplicate classification is not a fatal error, but my guess is
that somewhere, somehow, you are including classification.config
twice.  Look through your snort.conf and make sure it's only listed
once.

The fatal error is that your EXTERNAL_NET variable is not defined. 
Defining HOME_NET and EXTERNAL_NET is one of the first things you are
supposed to do when editing snort.conf (have you read through the
comments???).   Usually, you define HOME_NET as the networks you are
monitoring, and EXTERNAL_NET is defined as everything else
(!$HOME_NET)

HTH

On Sat, 18 Sep 2004 00:58:36 +0300, Juan Fernandez
<juan.fernandez at ...2210...> wrote:
> you Were right !!!!!
> 
> but know I recieve another FATAL ERROR:
> 
> here is what I see in /var/log/messeges:
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(30):
> Duplicate classification "not-suspicious"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(31):
> Duplicate classification "unknown"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(32):
> Duplicate classification "bad-unknown"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(33):
> Duplicate classification "attempted-recon"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(34):
> Duplicate classification "successful-recon-limited"found, ignoring this line
> 
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(35):
> Duplicate classification "successful-recon-largescale"found, ignoring this
> line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(36):
> Duplicate classification "attempted-dos"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(37):
> Duplicate classification "successful-dos"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(38):
> Duplicate classification "attempted-user"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(39):
> Duplicate classification "unsuccessful-user"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(40):
> Duplicate classification "successful-user"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(41):
> Duplicate classification "attempted-admin"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(42):
> Duplicate classification "successful-admin"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(46):
> Duplicate classification "rpc-portmap-decode"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(47):
> Duplicate classification "shellcode-detect"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(48):
> Duplicate classification "string-detect"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(49):
> Duplicate classification "suspicious-filename-detect"found, ignoring this
> line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(50):
> Duplicate classification "suspicious-login"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(51):
> Duplicate classification "system-call-detect"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(52):
> Duplicate classification "tcp-connection"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(53):
> Duplicate classification "trojan-activity"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(54):
> Duplicate classification "unusual-client-port-connection"found, ignoring
> this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(55):
> Duplicate classification "network-scan"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(56):
> Duplicate classification "denial-of-service"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(57):
> Duplicate classification "non-standard-protocol"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(58):
> Duplicate classification "protocol-command-decode"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(59):
> Duplicate classification "web-application-activity"found, ignoring this line
> 
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(60):
> Duplicate classification "web-application-attack"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(61):
> Duplicate classification "misc-activity"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(62):
> Duplicate classification "misc-attack"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(63):
> Duplicate classification "icmp-event"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(64):
> Duplicate classification "kickass-porn"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(65):
> Duplicate classification "policy-violation"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: /etc/snort/classification.config(66):
> Duplicate classification "default-login-attempt"found, ignoring this line
> Sep 18 00:50:17 sensjrlan snort: FATAL ERROR: Undefined variable name:
> (/etc/snort/rules/bad-traffic.rules:12): EXTERNAL_NET
> 
> I really appreciate your help !!!
> 
> Thanks !!!




More information about the Snort-users mailing list