snort.conf doesn't recognize internal address

[David Lambert <dave () demo legallock com>]

I am new to snort, so please forgive me if this is trivial question.
If I specify HOME_NET as $eth1_ADDRESS I get the following error on Linux:

 Parsing Rules file snort.conf

+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
[!] ERROR snort.conf (48): Bad value in variable definition!
       Make sure you don't have a "$" in the var name
Fatal Error, Quitting..

The output from my ifconfig is:

eth0      Link encap:Ethernet  HWaddr 00:10:4B:2C:91:C8
          inet addr:207.70.162.2  Bcast:207.70.162.255  Mask:255.255.255.0
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:1028218 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1161153 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:541290063 (516.2 Mb)  TX bytes:181369655 (172.9 Mb)
          Interrupt:10 Base address:0xdc00

eth1      Link encap:Ethernet  HWaddr 00:01:03:DD:0E:1D
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:732848 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1121925 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:142619286 (136.0 Mb)  TX bytes:1255335051 (1197.1 Mb)
          Interrupt:11 Base address:0xe000

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:31942688 errors:0 dropped:0 overruns:0 frame:0
          TX packets:31942688 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:1447916537 (1380.8 Mb)  TX bytes:1447916537 (1380.8 Mb)

Specifying my HOME_NET as var HOME_NET 192.168.1.0/24 works fine, as does 
eth0_ADDRESS (which of course is not my HOME_NET in this instance).

TIA for any help you can give.

Dave.



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users