Question re: FAQ 3.5....

[Bob Hillegas <bobhillegas () pdq net>]

I have a question about a section of the FAQ.
---- snip ----
3.5 --faq-- --snort-- --faq-- --snort-- --faq-- --snort-- --faq--
Q: IP address is assigned dynamically to my interface, can I use snort with it?

A:  Yes.With snort 1.7 and later, <interface>_ADDRESS variable is available.
    The value of this variable will be always set to IP address/Netmask of the
    interface which you run snort at. if interface goes down and up again (and
    an IP address is reassigned) you will have to restart snort. For earlier
    versions of snort numerous scripts to achieve the same result are
    available.
---- snip ----

I tried to access this by the following:
var HOME_NET ppp0_ADDRESS
var EXTERNAL_NET !$HOME_NET

This exits with an undefined variable error.
---- snip ----
ERROR /etc/snort/snort.conf (228) => Couldn't resolve hostname ppp0_ADDRESS
Fatal Error, Quitting..
---- snip ----

Obviously I am misinterpretting the '<intrerface>_ADDRESS variable is
available'. How is this value accessed?

Thanks

-- 
-------------------------------------------------
Bob Hillegas
<bobhillegas () pdq net>
281.546.9311


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users