Snort Forums Archive

Archive Home » Windows » snort 2.6.0.2 specifying an interface by _ADDRESS w/in the .conf

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

snort 2.6.0.2 specifying an interface by _ADDRESS w/in the .conf

Posted by nevdull on November 18, 2006 06:47:13

snort -w
Interface Device Description
-------------------------------------------
4 \Device\NPF_{A92D416F-AA90-4831-AD4B-A18CFF61B8EA} (Intel(R) PRO/1000 CT Network Connection)

add to snort.conf:::
var HOME_NET $(\Device\NPF_{A92D416F-AA90-4831-AD4B-A18CFF61B8EA}_ADDRESS)

run snort, errors out:::
ERROR: Undefined variable name: (d:\tools\ids\net\snort\snort.conf:51): \Device\NPF_{A92D416F-AA90-4831-AD4B-A18CFF61B8EA}_ADDRESS Fatal Error, Quitting..

change snort.conf to:::
var HOME_NET any

run snort, everything is peachy:::
Initializing Network Interface \Device\NPF_{A92D416F-AA90-4831-AD4B-A18CFF61B8EA}
Var '\Device\NPF_{A92D416F-AA90-4831-AD4B-A18CFF61B8EA}_ADDRESS' defined, value len = 25 chars, value = jo.mom.a.a/255.255.255.0
Decoding Ethernet on interface \Device\NPF_{A92D416F-AA90-4831-AD4B-A18CFF61B8EA}
--== Initialization Complete ==--

what gives? whats the magic syntax i need to get the builtin _ADDRESS variable to work?
(id prefer not to have to specify the -i option on the command line, as my interface order changes on this system, so don't reply with that as the answer *g*).

Posted by nevdull on November 20, 2006 17:28:30

2.6.1 fixes this...