[Snort-users] Snort 2.9.0 ipvar unknown rule type

Danny Paul JDPAUL at ...14549...
Tue Oct 19 10:52:19 EDT 2010


I did not - I didn't need ipv6. Should I have?

>>> On 10/19/2010 at 9:49 AM, in message
<AANLkTim8sGf3ZBWnAwt0eqaJNWTAkr-_YZZdvVassgcf at ...11828...>,
<rcombs at ...1935...> wrote:
> Did you configure with --enable-ipv6?
> 
> On Tue, Oct 19, 2010 at 10:22 AM, Danny Paul
<JDPAUL at ...14548...>wrote:
> 
>> Greetings,
>>
>> I have just installed snort 2.9.0 on OpenSuSE 11.3. I'm attempting
to
>> use the VRT certified rules, but I get the following error:
>>
>> ...
>> Parsing Rules file "rules/etc/snort.conf"
>> ERROR: rules/etc/snort.conf(39) Unknown rule type: ipvar.
>> Fatal Error, Quitting..
>>
>> If I change "ipvar" back to "var", everything runs fine, but I want
to
>> remain compatible with future versions, and var will be deprecated
at
>> some point.
>>
>> The OpenSuSE installation is brand new, `snort -V` reports "Version
>> 2.9.0 (Build 68) i386." I'm using libpcap version 1.1.1 and PCRE
version
>> 7.9. I think this must be a bug because I cannot seem to find
anything
>> else wrong.
>>
>> Is anyone else having the same problem?
>>
>>
>>
------------------------------------------------------------------------------
>> Download new Adobe(R) Flash(R) Builder(TM) 4
>> The new Adobe(R) Flex(R) 4 and Flash(R) Builder(TM) 4 (formerly
>> Flex(R) Builder(TM)) enable the development of rich applications
that run
>> across multiple browsers and platforms. Download your free trials
today!
>> http://p.sf.net/sfu/adobe-dev2dev 
>> _______________________________________________
>> Snort-users mailing list
>> Snort-users at lists.sourceforge.net 
>> Go to this URL to change user options or unsubscribe:
>> https://lists.sourceforge.net/lists/listinfo/snort-users 
>> Snort-users list archive:
>> http://www.geocrawler.com/redir-sf.php3?list=snort-users 
>>




More information about the Snort-users mailing list