RE: Running Snort 1.9.0 from shell script

["Wayne T Work" <securitygauntlet () snet net>]

You are pointing to the right snort.conf. The newer version has several
variables (Port numbers) that the rules apply too. Also, make sure your have
the right rules in place.

Cheers!
Wayne

-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net]On Behalf Of Michael
Boman
Sent: Monday, October 14, 2002 10:30 PM
To: Eric Joe
Cc: snort-users () lists sourceforge net
Subject: Re: [Snort-users] Running Snort 1.9.0 from shell script


On Mon, Oct 14, 2002 at 10:11:40PM -0400, Eric Joe wrote:
> I had been running Snort 1.8.7 from a simple shell script like this
>
> #!/bin/sh
> /usr/local/bin/snort -d -c /home/snort-1.9.0/etc/snort.conf -o &
>
> Now, with version 1.9.0 I get this error when I run it from a shell.
>
> ERROR => Undefined variable name: (../rules/exploit.rules:22): SMTP
>
> I am running the bash shell on
>
> 2.4.18-5smp kernel
>
> If I type out the same exact command in a shell, it works fine!
>
> I am baffled. Can someone set me straight?

IFAIK
        var SMTP $HOME_NET
has been replaced with
        var SMTP_SERVERS $HOME_NET

or you have a misspelled rule. Double-check your $VARIABLE useage against
what you define with 'var VARIABLE value' statements.

Best regards
 Michael Boman

--
Michael Boman
Student, Husband, Geek. Not necessary in that order though.



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users





-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users