Re: Question re: FAQ 3.5....

[Mike Baptiste <mike () baptistefamily net>]

Its a variable - try $ppp0_ADDRESS

Mike

Bob Hillegas wrote:
> I have a question about a section of the FAQ.
> ---- snip ----
> 3.5 --faq-- --snort-- --faq-- --snort-- --faq-- --snort-- --faq--
> Q: IP address is assigned dynamically to my interface, can I use snort with it?
>
> A:  Yes.With snort 1.7 and later, <interface>_ADDRESS variable is available.
>     The value of this variable will be always set to IP address/Netmask of the
>     interface which you run snort at. if interface goes down and up again (and
>     an IP address is reassigned) you will have to restart snort. For earlier
>     versions of snort numerous scripts to achieve the same result are
>     available.
> ---- snip ----
>
> I tried to access this by the following:
> var HOME_NET ppp0_ADDRESS
> var EXTERNAL_NET !$HOME_NET
>
> This exits with an undefined variable error.
> ---- snip ----
> ERROR /etc/snort/snort.conf (228) => Couldn't resolve hostname ppp0_ADDRESS
> Fatal Error, Quitting..
> ---- snip ----
>
> Obviously I am misinterpretting the '<intrerface>_ADDRESS variable is
> available'. How is this value accessed?
>
> Thanks



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users