[Snort-users] FATAL ERROR: /usr/local/etc/snort.conf(45) Unknown rule type: ipvar.

waldo kitty wkitty42 at ...14940...
Mon Aug 15 22:42:11 EDT 2011

On 8/15/2011 22:22, Joel Esler wrote:
> Look at the top of the snort.conf file. You should see our recommended compile
> options.

FWIW: that would be the snort.conf distributed with the snort source code OR the 
one included in the sourcefire rules archive... i forget where it is but i had 
to go looking some time back because the snort.conf out installs were using was 
a rather ancient one and (thankfully) it was not being overwritten when rules 
and snort versions were updated... "thankfully" because our customizations would 
have been lost and that would not have been a pretty picture with complaints 
coming from several hundred thousand installs...

> Sent from my iPhone
> On Aug 15, 2011, at 21:32, alexus <alexus at ...11827... <mailto:alexus at ...11827...>>
> wrote:
>> Anything specific ?
>> On Aug 15, 2011 8:59 PM, "Joel Esler"
>> <<mailto:jesler at ...1935...>jesler at ...1935...
>> <mailto:jesler at ...1935...>> wrote:
>> > Sounds like you may need to take a look at our recommended compile options
>> at the top of the snort.conf in the etc/ directory.

More information about the Snort-users mailing list