[Snort-users] $eth1_ADDRESS still a valid variable in

Starner, Mark mark.starner at ...5850...
Tue Feb 17 12:03:17 EST 2015

I retract my question. I configured "-enable-sourcefire" for the first time
and found the comment in parser.c that said the $IF_ADDRESS variables are
not defined if Sourcefire is enabled and snort is not running as root. So I
recompiled without "-enable-sourcefire" and all is well.


Maybe this will help anyone else who comes across this.





From: Starner, Mark [mailto:mark.starner at ...5850...] 
Sent: Tuesday, February 17, 2015 11:33 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] $eth1_ADDRESS still a valid variable in


I use $eth1_ADDRESS in one of my local rules, and when snort starts,
it says:

ERROR: rules/local.rules(8) Undefined variable in the string: $eth1_ADDRESS.


I think I encountered this with a previous upgrade, but I don't recall how I
resolved it.



1)      Is this still valid with

2)      If Yes, then what would cause this NOT to be defined (yes, I
verified I have an eth1 and it has an IP address defined.





-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150217/64177bdd/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 9426 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150217/64177bdd/attachment.bin>

More information about the Snort-users mailing list