[Snort-users] ERROR: Undefined variable name: (/etc/snort/rules/bad-traffic.rules:12): EXTERNAL_NET

Briggs, Bruce Bruce.Briggs at ...13183...
Sat Apr 9 14:56:23 EDT 2005

Is EXTERNAL_NET properly defined in snort.conf?


-----Original Message-----
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Mark
Sent: Saturday, April 09, 2005 5:25 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] ERROR: Undefined variable name:
(/etc/snort/rules/bad-traffic.rules:12): EXTERNAL_NET

Hi All,

anyone seen this error b4..? I've checked my snort.conf file and
confirmed that the rules path = /etc/snort/rules,

var RULE_PATH /etc/snort/rules

 and here is the rules dir content,

[root at ...274... snort]# cd /etc/snort
[root at ...274... snort]# ls
classification.config  reference.config  rules  snort.conf
snort.conf.rpmsave  unicode.map [root at ...274... snort]# cd rules
[root at ...274... rules]# ls
attack-responses.rules  ftp.rules         mysql.rules      
rservices.rules    web-client.rules
backdoor.rules          icmp-info.rules   netbios.rules    
scan.rules         web-coldfusion.rules
bad-traffic.rules       icmp.rules        nntp.rules       
shellcode.rules    web-frontpage.rules
chat.rules              imap.rules        oracle.rules     
smtp.rules         web-iis.rules
ddos.rules              info.rules        other-ids.rules  
snmp.rules         web-misc.rules
deleted.rules           local.rules       p2p.rules        
sql.rules          web-php.rules
dns.rules               Makefile          policy.rules     
telnet.rules       x11.rules
dos.rules               Makefile.am       pop2.rules       tftp.rules
experimental.rules      Makefile.in       pop3.rules       virus.rules
exploit.rules           misc.rules        porn.rules
finger.rules            multimedia.rules  rpc.rules        web-cgi.rules

Error given when running the following in the terminal,

[root at ...274... snort]# /usr/local/bin/snort -c /etc/snort/snort.conf -i
eth0 -g snort

database: compiled support for ( mysql )
database: configured to use mysql
database:          user = snort
database: password is set
database: database name = snort
database:          host = localhost
database:   sensor name =
database:     sensor id = 1
database: schema version = 106
database: using the "log" facility
ERROR: Undefined variable name: (/etc/snort/rules/bad-traffic.rules:12):

Fatal Error, Quitting..


Mark Sargent.

SF email is sponsored by - The IT Product Guide Read honest & candid
reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list