Re: Snort++ Problem with Rules

[wkitty42 () windstream net]

On 08/09/2017 11:51 AM, Jim Campbell wrote:
> Loading snort3.rules:
> ERROR: snort3.rules:3690 !any is not allowed: ![$SMTP_SERVERS,$DNS_SERVERS].
> ERROR: snort3.rules:5648 !any is not allowed: !$SMTP_SERVERS.
> ERROR: snort3.rules:5648 !any is not allowed: !$HOME_NET.
> ERROR: snort3.rules:5659 !any is not allowed: !$HOME_NET.
> Finished snort3.rules.
> ...
>
> I'm commenting these rules (#alert...) until the problem is fixed.


you should post or at least look at what your $SMTP_SERVERS, $DNS_SERVERS, and 
$HOME_NET are set to... if they are "any", then that's your problem and you 
should correct it in your config OR, as you have done, disable those rules...

in other words, the problem is in your config...

--
 NOTE: No off-list assistance is given without prior approval.
       *Please keep mailing list traffic on the list unless*
       *a signed and pre-paid contract is in effect with us.*
_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!