[Snort-users] Snort Error

Al Lewis (allewi) allewi at ...589...
Wed Jan 18 19:03:08 EST 2017

Looks like you need to set EXTERNAL_NET to something.

Take a look at the default config that comes with the download.

cliffjumper$ less /var/tmp/snort- | grep EXTERNAL
ipvar EXTERNAL_NET any

Albert Lewis
SOURCEfire, Inc. now part of Cisco
Email: allewi at ...589...<mailto:allewi at ...589...>

From: Paraskevas Lampadas <parislampadas at ...11827...<mailto:parislampadas at ...11827...>>
Date: Wednesday, January 18, 2017 at 6:51 PM
To: waldo kitty <wkitty42 at ...14940...<mailto:wkitty42 at ...14940...>>
Cc: 'snort-users' <snort-users at lists.sourceforge.net<mailto:snort-users at lists.sourceforge.net>>
Subject: Re: [Snort-users] Snort Error

" FATAL ERROR: /etc/snort/snort.conf(48) Missing argument to EXTERNAL_NET"

The exact error message

Με εκτίμηση,

Λαμπαδάς Πάρης
Μηχανικός Πληροφορικής Τ.Ε.
Cisco Certified Network Associate

On Thu, Jan 19, 2017 at 1:43 AM, Paraskevas Lampadas <parislampadas at ...11827...<mailto:parislampadas at ...11827...>> wrote:
FATAL ERROR variable EXTERNAL_NET not set, or something like that.

Με εκτίμηση,

Λαμπαδάς Πάρης
Μηχανικός Πληροφορικής Τ.Ε.
Cisco Certified Network Associate

On Wed, Jan 18, 2017 at 4:02 AM, <wkitty42 at ...14940...<mailto:wkitty42 at ...14940...>> wrote:
On 01/17/2017 04:37 PM, Paraskevas Lampadas wrote:
> I tried to make as !$HOME NET, but then the snort fails to load at startup.
> If i change it back to any everything works fine.
> How else can i avoid receiving alerts from my internal network?

what is the exact error message given at startup when you set EXTERNAL_NET to

  NOTE: No off-list assistance is given without prior approval.
        *Please keep mailing list traffic on the list* unless
        private contact is specifically requested and granted.

Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
Snort-users mailing list
Snort-users at lists.sourceforge.net<mailto:Snort-users at lists.sourceforge.net>
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

Please visit http://blog.snort.org to stay current on all the latest Snort news!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20170119/9279a5a1/attachment.html>

More information about the Snort-users mailing list