[Snort-users] frag3 bind_to and ipvar not working

Lee Clemens snort at ...13080...
Fri Mar 12 21:21:06 EST 2010


I am using Snort on Linux kernel 2.6.x.

My snort.conf contains (was running on


preprocessor frag3_global: max_frags 65536, \
   prealloc_frags 65536, \
   memcap 524288
preprocessor frag3_engine: policy linux \
	bind_to $LINUX_SERVERS \

However, starting snort fails each time on the frag3_engine line.

I have tried using slash-notation for each IP, and using ipvar instead of
Each time I get the error: Unable to process the IP address: LINUX_SERVERS.

If I wrap use $(LINUX_SERVERS) or [$LINUX_SERVERS], etc, I receive the same
error but with or without brackets.

Using var and $(LINUX_SERVERS:?linux not defined), I receive the error
"linux not defined".

Any help would be greatly appreciated.


More information about the Snort-users mailing list