[Snort-users] Snort + NIDS + SLES10 problem

maged shaker maged.shaker at ...14064...
Tue Feb 13 04:55:01 EST 2007


Dear all 
I was installed SuSE Linux Enterprise Server 10 on HP pro370  , with one
Ethernet  then i configured snort-2.4.4-10.4 that are coming with SLES10
distribution with snort file under /etc/sysconfig/snort ,and insert the
interface in this file as the following :
SNORT_INTERFACE="eth0"
then  start the  snort daemon under /etc/init.d/snort , and it  start
successfully , so snort was started to act as "HIDS" Host Intrusion
detection system  , but the problem  with the next scenario  when enable
snort as "NIDS" Network Intrusion detection system 

SLES10 has two  network address , one configured with IP to allow
administrator to monitoring and view the "Base"  Basic Analysis and
Security Engine ,and the other interface is not configured  to use for
sniffing  the traffic and configured with snort , and it attached to
span port in the switch  but when insert the other network address
in /etc/sysconfig/snort  as the following :
SNORT_INTERFACE="eth1 "and start snort it failed when  start and tell me
in /var/log/message :
Parsing Rules file /etc/snort/snort.conf
Feb 10 05:59:42 linux1 snort[9023]: FATAL ERROR: Undefined variable
name: (/etc/snort/snort.conf:44): eth1_ADDRESS

please give me advice for this issue and how to solve it 

Thanks 
NSM-man
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20070213/b26f8c80/attachment.html>


More information about the Snort-users mailing list