[Snort-users] Failed to parse the IP address: $HOME_NET

Lay, James james.lay at ...15009...
Thu Aug 16 16:10:05 EDT 2012



-----Original Message-----
From: Chiesa Stefano [mailto:Stefano.Chiesa at ...15753...] 
Sent: Thursday, August 16, 2012 9:32 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Failed to parse the IP address: $HOME_NET

<snip>

ERROR: /etc/snort/../rules/snort.rules(7073) !any is not allowed:
!$HOME_NET.
Fatal Error, Quitting..
+++++++++++++++++++++++++++++++++++++++++++++++++++

I understood I have to configure the HOME_NET variable (I have almost
all the variables at the "any" value).
But, and this is the main problem, no matter what I write to configure
the variable I always get an error.

ipvar H0ME_NET 212.239.x.x/25		w/o brackets
ipvar H0ME_NET [212.239.x.x/25]	w/ brackets
ipvar H0ME_NET [172.16.40.111] w/ single internal address

using 'ipvar' or simply 'var' I get these errors:

[root at ...15754... ~]# /usr/sbin/snort -T -d -i eth0 -u snort -g snort -c
/etc/snort/snort.conf -l /home/snort/log/eth0
Running in Test mode

        --== Initializing Snort ==--
Initializing Output Plugins!
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file "/etc/snort/snort.conf"
ERROR: /etc/snort/snort.conf(55) Failed to parse the IP address:
$HOME_NET.
Fatal Error, Quitting..

<snip>


Stefano,

Can we see the first say...20 lines of your snort.conf?  Thanks.

James




More information about the Snort-users mailing list