Snort mailing list archives
Re: Question re: FAQ 3.5....
From: Bob Hillegas <bobhillegas () pdq net>
Date: Fri, 17 Aug 2001 08:25:05 -0500 (CDT)
Thanks for taking time to point out the obvious. (At least to some of us) %-( BobH -- ------------------------------------------------- Bob Hillegas <bobhillegas () pdq net> 281.546.9311 On Fri, 17 Aug 2001, Mike Baptiste wrote:
Date: Fri, 17 Aug 2001 08:41:55 -0400 From: Mike Baptiste <mike () baptistefamily net> To: Bob Hillegas <bobhillegas () pdq net> Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] Question re: FAQ 3.5.... Its a variable - try $ppp0_ADDRESS Mike Bob Hillegas wrote:I have a question about a section of the FAQ. ---- snip ---- 3.5 --faq-- --snort-- --faq-- --snort-- --faq-- --snort-- --faq-- Q: IP address is assigned dynamically to my interface, can I use snort with it? A: Yes.With snort 1.7 and later, <interface>_ADDRESS variable is available. The value of this variable will be always set to IP address/Netmask of the interface which you run snort at. if interface goes down and up again (and an IP address is reassigned) you will have to restart snort. For earlier versions of snort numerous scripts to achieve the same result are available. ---- snip ---- I tried to access this by the following: var HOME_NET ppp0_ADDRESS var EXTERNAL_NET !$HOME_NET This exits with an undefined variable error. ---- snip ---- ERROR /etc/snort/snort.conf (228) => Couldn't resolve hostname ppp0_ADDRESS Fatal Error, Quitting.. ---- snip ---- Obviously I am misinterpretting the '<intrerface>_ADDRESS variable is available'. How is this value accessed? Thanks
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Question re: FAQ 3.5.... Bob Hillegas (Aug 17)
- Re: Question re: FAQ 3.5.... Mike Baptiste (Aug 17)
- Re: Question re: FAQ 3.5.... Bob Hillegas (Aug 17)
- Re: Question re: FAQ 3.5.... Mike Baptiste (Aug 17)