[Snort-users] Snort 2.9.0 ipvar unknown rule type

Russ Combs rcombs at ...1935...
Tue Oct 19 10:56:18 EDT 2010


On Tue, Oct 19, 2010 at 10:52 AM, Danny Paul <JDPAUL at ...14548...>wrote:

> I did not - I didn't need ipv6. Should I have?
>

Yes - to get ipvars.

>
> >>> On 10/19/2010 at 9:49 AM, in message
> <AANLkTim8sGf3ZBWnAwt0eqaJNWTAkr-_YZZdvVassgcf at ...11828...>,
> <rcombs at ...1935...> wrote:
> > Did you configure with --enable-ipv6?
> >
> > On Tue, Oct 19, 2010 at 10:22 AM, Danny Paul
> <JDPAUL at ...14548...>wrote:
> >
> >> Greetings,
> >>
> >> I have just installed snort 2.9.0 on OpenSuSE 11.3. I'm attempting
> to
> >> use the VRT certified rules, but I get the following error:
> >>
> >> ...
> >> Parsing Rules file "rules/etc/snort.conf"
> >> ERROR: rules/etc/snort.conf(39) Unknown rule type: ipvar.
> >> Fatal Error, Quitting..
> >>
> >> If I change "ipvar" back to "var", everything runs fine, but I want
> to
> >> remain compatible with future versions, and var will be deprecated
> at
> >> some point.
> >>
> >> The OpenSuSE installation is brand new, `snort -V` reports "Version
> >> 2.9.0 (Build 68) i386." I'm using libpcap version 1.1.1 and PCRE
> version
> >> 7.9. I think this must be a bug because I cannot seem to find
> anything
> >> else wrong.
> >>
> >> Is anyone else having the same problem?
> >>
> >>
> >>
>
> ------------------------------------------------------------------------------
> >> Download new Adobe(R) Flash(R) Builder(TM) 4
> >> The new Adobe(R) Flex(R) 4 and Flash(R) Builder(TM) 4 (formerly
> >> Flex(R) Builder(TM)) enable the development of rich applications
> that run
> >> across multiple browsers and platforms. Download your free trials
> today!
> >> http://p.sf.net/sfu/adobe-dev2dev
> >> _______________________________________________
> >> Snort-users mailing list
> >> Snort-users at lists.sourceforge.net
> >> Go to this URL to change user options or unsubscribe:
> >> https://lists.sourceforge.net/lists/listinfo/snort-users
> >> Snort-users list archive:
> >> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> >>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20101019/7dd65075/attachment.html>


More information about the Snort-users mailing list