Snort mailing list archives

Re: X-late problem


From: Dragos Ruiu <dr () kyx net>
Date: Wed, 4 Jul 2001 22:49:14 -0700

Get rid of the quotes around the IP addr.

This one comes up enough that it not only is an FAQ candiate,
but might also be worthy of more parser candy to inform users
a little more self-evidently.  Though this error messag does make 
me chuckle every time I see it. :-)

I guess I should not whine but get off my ass and produce a parser patch.
I'll put it on the todo as soon as I figure out why some people's 
defraggers seem to be using unexpected amounts of memory.

cheers,
--dr 

On Wed, 04 Jul 2001, you wrote:
After a seemingly successfull source-rpm installation on a RH 7.0 
system, I get the following error:

=== Cut ===
Jul  4 16:24:06 kb1 snort: ERROR /etc/snort/snort.conf (7) => Rule IP 
addr ("216.126.66.210") didn't x-late, WTF?
Jul  4 16:24:06 kb1 snortd: snort startup succeeded

=== Cut ===

Despite the success report, snort does not start. The IP address is 
correct, and a similar setup on another machine works fine.

KS

   KARICO Business Services
   Toronto, ON Canada
   http://www.karico.ca




_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-- 
Dragos Ruiu <dr () dursec com>   dursec.com ltd. / kyx.net - we're from the future 
gpg/pgp key on file at wwwkeys.pgp.net or at http://dursec.com/drkey.asc

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: