maged shaker wrote:
Dear all
I was installed SuSE Linux Enterprise Server 10 on HP pro370 , with
one Ethernet then i configured snort-2.4.4-10.4 that are coming with
SLES10 distribution with snort file under /etc/sysconfig/snort ,and
insert the interface in this file as the following :
SNORT_INTERFACE="eth0"
then start the snort daemon under /etc/init.d/snort , and it start
successfully , so snort was started to act as "HIDS" Host Intrusion
detection system , but the *problem* with the *next* *scenario*
when enable snort as "NIDS" Network Intrusion detection system
SLES10 has two network address , one configured with IP to allow
administrator to monitoring and view the "Base" Basic Analysis and
Security Engine ,and the other interface is not configured to use for
sniffing the traffic and configured with snort , and it attached to
span port in the switch but when insert the other network address in
/etc/sysconfig/snort as the following :
SNORT_INTERFACE="eth1 "and start snort it failed when start and tell
me in /var/log/message :
Parsing Rules file /etc/snort/snort.conf
Feb 10 05:59:42 linux1 snort[9023]: FATAL ERROR: Undefined variable
name: (/etc/snort/snort.conf:44): eth1_ADDRESS
please give me advice for this issue and how to solve it
Thanks
NSM-man
------------------------------------------------------------------------
Sounds like your config file is not defining eth1_ADDRESS before using
it (maybe because that interface doesn't have an ip address and so SUSE
doesn't define it - I'm guessing SUSE is mucking with the config file
based on what you put in /etc/sysconfig/snort). Can you please post
your config file (/etc/snort/snort.conf), /etc/sysconfig/snort and the
SUSE init script?
Thanks
Todd
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier.
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
