[Snort-users] $eth1_ADDRESS still a valid variable in 2.9.7.0?

Starner, Mark mark.starner at ...5850...
Tue Feb 17 12:03:17 EST 2015


I retract my question. I configured "-enable-sourcefire" for the first time
and found the comment in parser.c that said the $IF_ADDRESS variables are
not defined if Sourcefire is enabled and snort is not running as root. So I
recompiled without "-enable-sourcefire" and all is well.

 

Maybe this will help anyone else who comes across this.

 

Mark

 

 

From: Starner, Mark [mailto:mark.starner at ...5850...] 
Sent: Tuesday, February 17, 2015 11:33 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] $eth1_ADDRESS still a valid variable in 2.9.7.0?

 

I use $eth1_ADDRESS in one of my local rules, and when snort 2.9.7.0 starts,
it says:

ERROR: rules/local.rules(8) Undefined variable in the string: $eth1_ADDRESS.

 

I think I encountered this with a previous upgrade, but I don't recall how I
resolved it.

 

So

1)      Is this still valid with 2.9.7.0?

2)      If Yes, then what would cause this NOT to be defined (yes, I
verified I have an eth1 and it has an IP address defined.

 

Thanks

Mark

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150217/64177bdd/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 9426 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150217/64177bdd/attachment.bin>


More information about the Snort-users mailing list