ERROR: Undefined variable name: (/etc/snort/rules/bad-traffic.rules:12): EXTERNAL_NET

[Mark Sargent <powderkeg () snow email ne jp>]

Hi All,

anyone seen this error b4..? I've checked my snort.conf file and 
confirmed that the rules path = /etc/snort/rules,

var RULE_PATH /etc/snort/rules

and here is the rules dir content,

[root@localhost snort]# cd /etc/snort
[root@localhost snort]# ls
classification.config  reference.config  rules  snort.conf  
snort.conf.rpmsave  unicode.map
[root@localhost snort]# cd rules
[root@localhost rules]# ls
attack-responses.rules  ftp.rules         mysql.rules      
rservices.rules    web-client.rules
backdoor.rules          icmp-info.rules   netbios.rules    
scan.rules         web-coldfusion.rules
bad-traffic.rules       icmp.rules        nntp.rules       
shellcode.rules    web-frontpage.rules
chat.rules              imap.rules        oracle.rules     
smtp.rules         web-iis.rules
ddos.rules              info.rules        other-ids.rules  
snmp.rules         web-misc.rules
deleted.rules           local.rules       p2p.rules        
sql.rules          web-php.rules
dns.rules               Makefile          policy.rules     
telnet.rules       x11.rules
dos.rules               Makefile.am       pop2.rules       tftp.rules
experimental.rules      Makefile.in       pop3.rules       virus.rules
exploit.rules           misc.rules        porn.rules       web-attacks.rules
finger.rules            multimedia.rules  rpc.rules        web-cgi.rules 

Error given when running the following in the terminal,

[root@localhost snort]# /usr/local/bin/snort -c /etc/snort/snort.conf -i 
eth0 -g snort

database: compiled support for ( mysql )
database: configured to use mysql
database:          user = snort
database: password is set
database: database name = snort
database:          host = localhost
database:   sensor name = 192.168.0.17
database:     sensor id = 1
database: schema version = 106
database: using the "log" facility
ERROR: Undefined variable name: (/etc/snort/rules/bad-traffic.rules:12): 
EXTERNAL_NET
Fatal Error, Quitting..

Cheers.

Mark Sargent.


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users