[Snort-users] Snort 3 reputation configuration

Aurimas Rudinskis arudinskis at ...11827...
Mon Dec 21 09:48:45 EST 2015


Hi,

I'm trying to configure Snort 3 (aka Snort++) snort.lua. I've tried to add
some IPs to 'white_list.rules' and 'black_list.rules' files, but didn't
helped. Still getting an error about global 'white_list'.

How can I solve this?

WHITE_LIST_PATH = '/etc/snort/rules'
BLACK_LIST_PATH = '/etc/snort/rules'

reputation =
{
    memcap = 500,
    priority = 'whitelist',
    nested_ip = 'inner',
    whitelist = WHITE_LIST_PATH/white_list.rules,
    blacklist = BLACK_LIST_PATH/black_list.rules,
}

snort -T -c /etc/snort/snort.lua -i eth0
--------------------------------------------------
o")~   Snort++ 3.0.0-a3-183
--------------------------------------------------
Loading /etc/snort/snort.lua:
FATAL: can't init /etc/snort/snort.lua: /etc/snort/snort.lua:1321: attempt
to index global 'white_list' (a nil value)
Fatal Error, Quitting..
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20151221/a8ca3f1d/attachment.html>


More information about the Snort-users mailing list