[Snort-users] issue of installing Snort_2.8.4.1 and Barnyard2 in Ubunto 9.10

Jun Wan junwei_wan at ...125...
Fri Mar 5 00:20:59 EST 2010

Hi Rob,


I have fixed this issue by following your instructions, now my Snort is working beautifully.


Many thanks to others who helped on this issue as well.






Date: Wed, 3 Mar 2010 18:57:11 -0500
Subject: Re: [Snort-users] issue of installing Snort_2.8.4.1 and Barnyard2 in Ubunto 9.10
From: rob.l.dixon at ...11827...
To: junwei_wan at ...125...

Try setting your HOME_NET and EXTERNAL_NET like this:

var HOME_NET [,,]  (or what ever your internal network IP, CIDR or range is, this would be the netowrk that you want to protect.)


Hope that helps.


On Wed, Mar 3, 2010 at 6:27 PM, Jun Wan <junwei_wan at ...125...> wrote:


I am new to Snort, I followed the instructions on this url:  https://wwwx.cs.unc.edu/~hays/archives/work/index.php

All went well until I reached the following stage:

 "Now a quick test. Run the following and see if snort runs:

sudo snort -c /etc/snort/snort.conf -i eth1"

After running the command line above, I got the following outcomes:

Running in IDS mode

        --== Initializing Snort ==--
Initializing Output Plugins!
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file /etc/snort/snort.conf
Var 'HOME_NET' redefined
PortVar 'HTTP_PORTS' defined :  [ 80 ]
PortVar 'SHELLCODE_PORTS' defined :  [ 0:79 81:65535 ]
PortVar 'ORACLE_PORTS' defined :  [ 1521 ]
Frag3 global config:

Initializing rule chains...
ERROR: Undefined variable name: (/etc/snort/rules/bad-traffic.rules:27): EXTERNAL_NET
Fatal Error, Quitting..

Is there anyone know what's this all about? Would you please let me know "how to" fix this "Fatal Error"?  what should I do next?

Any information and help would be much appreciated.



Browse profiles for FREE! Meet local singles online.
Download Intel® Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

Hackers for Charity Board Member
GPEN, GAWN, C|HFI, ESSE-D, SnortCP, TNAP, TNCP, TECP, A+, whatever..

Bad news doesn't get any better with age.

Get the latest jobs delivered. Sign up for SEEK Jobmail.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20100305/c80869dd/attachment.html>

More information about the Snort-users mailing list