Snort 2.4.4 on CentOS 4.3 won't listen on ppp0

[John Messinger <john_messinger () acslink net au>]

Followed the installation guide from the Docs section (Snort, Apache, 
SSL, PHP, MySQL, and BASE Install on CentOS 4, RHEL 4 or Fedora Core), 
with the exception that I installed the official Snort 2.4.4 RHEL4 rpms 
(snort + snort-mysql).

Snort seems to start OK (no errors given anywhere, and syslog shows a 
good startup), but no sensors are listed in BASE - nada.

Running snort -c /etc/snort/snort.conf gives the following output:

***
*** interface device lookup found: eth0
***
Running in IDS mode

Initializing Network Interface eth0

--== Initializing Snort ==--
Initializing Output Plugins!
Decoding Ethernet on interface eth0
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file /etc/snort/snort.conf

+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
ERROR: Undefined variable name: (/etc/snort/snort.conf:33): ppp0_ADDRESS
Fatal Error, Quitting..

My snort.conf file defines HOME_NET as $ppp0_ADDRESS. I have modified 
/etc/sysconfig/snort so that the INTERFACE variable points to ppp0, and 
also the /etc/rc.d/init.d/snortd script.

As far as I can tell, snort should be getting called with the -i ppp0 
option, but it is still trying to listen on the eth0 interface.

My network setup is a DSL modem connected to eth1, with eth0 being the 
interface to the private LAN. Yes, the IP address from my ISP is 
dynamic, not fixed.

If more information is required, please let me know. Appreciate any 
suggestions as to getting this to work.

Regards,

John


-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users