Snort mailing list archives
RE: Couldn't resolve hostname HOME_NET
From: "L. Christopher Luther" <CLuther () Xybernaut com>
Date: Tue, 13 May 2003 18:16:47 -0400
Carlos, A couple of things: 1) The definition of EXTERNAL_NET should be 'var EXTERNAL_NET !$HOME_NET' -- you missed the $ sign required for macro/variable expansion. 2) Unless you're using multiple networks in the definition of HOME_NET, you don't need the brackets. That is, use 'var HOME_NET 10.0.0.66/27' I'm betting that it's the mis-defined EXTERNAL_NET that is causing you problems in your rules file. HTH, - Christopher -----Original Message----- From: Carlos Felix [mailto:snort () xiata com] Sent: Tuesday, May 13, 2003 5:32 PM To: snort-users () lists sourceforge net Subject: [Snort-users] Couldn't resolve hostname HOME_NET Hi folks, I am trying to research my current problem in the list archives but I am coming up with a ****************************** Not Found The requested URL /redir-sf.php3 was not found on this server. Apache/1.3.27 Server at www.geocrawler.com Port 80 ****************************** Any time I try to search the archives (http://www.geocrawler.com/redir-sf.php3?list=snort-users) so I'll ask a question that likely has already been answered. I have changed my snort.conf to define my home net as follows <Snip> var HOME_NET [10.0.0.66/27] # Set up the external network addresses as well. # A good start may be "any" var EXTERNAL_NET !HOME_NET </Snip> but when I try to run snort with the following command line /usr/sbin/snort -U -d -c /etc/snort/snort.conf -l /var/log/snort -i eth0 I get the following error ERROR: ERROR /etc/snort/rules/bad-traffic.rules(12): Couldn't resolve hostname HOME_NET Fatal Error, Quitting.. Can anyone shed light into this? I am using the latest version of the snort stable rules & have not modified them. Carlos ------------------------------------------------------- Enterprise Linux Forum Conference & Expo, June 4-6, 2003, Santa Clara The only event dedicated to issues related to Linux enterprise solutions www.enterpriselinuxforum.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- Enterprise Linux Forum Conference & Expo, June 4-6, 2003, Santa Clara The only event dedicated to issues related to Linux enterprise solutions www.enterpriselinuxforum.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Couldn't resolve hostname HOME_NET Carlos Felix (May 13)
- <Possible follow-ups>
- Re: Couldn't resolve hostname HOME_NET Neil Dickey (May 13)
- Re: Couldn't resolve hostname HOME_NET Carlos Felix (May 13)
- RE: Couldn't resolve hostname HOME_NET Schmehl, Paul L (May 13)
- RE: Couldn't resolve hostname HOME_NET L. Christopher Luther (May 13)