Re: [Snort-users] FATAL ERROR in bad-traffic.rules

*laugh* Yep. Seems to be my problem as well. I didn't have the
closing ] on the end. Guess I"ll go back to 2.1.3 and install it
again. Thanx for the pointer. I fixed it later when I was setting up
2.1.2 but didn't even think that was what was killing 2.1.3. Now if I
could just get it to actually recognize scans from nmap and nessus, I'd
be happy...

--Xantius

Mark E. Donaldson wrote:

>Thanks Joel. Such was the case. As it turned out I did have a space after a
>comma in my list and that was the problem. I guess the parser in 2.1.3 must
>have increased sensitivity. Let's see if we here back from Xantius.
>
>-----Original Message-----
>From: Joel Esler [mailto:esler@knology.net]
>Sent: Sunday, June 27, 2004 9:09 AM
>To: markee@bandwidthco.com
>Cc: 'Xantius'
>Subject: {Spam 0} RE: [Snort-users] FATAL ERROR in bad-traffic.rules
>
>Unterminated IP list sounds like in your snort.conf you have something like
>var HOME_NET [1.1.1.0/24,1.1.2.0/24,]
>
>Like you have it set up to expect another IP list...
>
>J
>
>-----Original Message-----
>From: snort-users-admin@lists.sourceforge.net
>[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of Mark E.
>Donaldson
>Sent: Saturday, June 26, 2004 2:05 PM
>To: 'Xantius'; snort-users@lists.sourceforge.net
>Subject: RE: [Snort-users] FATAL ERROR in bad-traffic.rules
>
>
>
>-----Original Message-----
>From: snort-users-admin@lists.sourceforge.net
>[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of Xantius
>Sent: Saturday, June 26, 2004 7:58 AM
>To: snort-users@lists.sourceforge.net
>Subject: [Snort-users] FATAL ERROR in bad-traffic.rules
>
>After hours of trying to get snort installed and working, I feel like I'm
>getting close. But when I start up snort, it dies with the following
>message.
>
>FATAL ERROR: /etc/snort/rules/bad-traffic.rules(12) => Unterminated IP List
>
>These rules are stock right out of the box. No idea what the problem is...
>Anyone?
>
>--Xantius
>
>Let me guess. You're trying to install Snort 2.1.3? That's my guess because
>I have run into the same difficulty. Been using snort all the way back since
>day one and have never had any trouble to speak of that I couldn't solve. So
>far no luck on this one. So, I went back to 2.1.2 until I have more time to
>figure it out. Whatever the problem, it seems unique to 2.1.3.
>
>
>
>
>-------------------------------------------------------
>This SF.Net email sponsored by Black Hat Briefings & Training.
>Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital self
>defense, top technical experts, no vendor pitches, unmatched networking
>opportunities. Visit www.blackhat.com
>_______________________________________________
>Snort-users mailing list
>Snort-users@lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>https://lists.sourceforge.net/lists/...fo/snort-users
>Snort-users list archive:
>http://www.geocrawler.com/redir-sf.p...st=snort-users
>
>
>################################################# #######
>This message has been scanned for viruses and dangerous content by
>MailScanner, and is believed to be clean.
>
>postmaster@bandwidthco.com
>MailScanner at bandwidthco.com is for your absolute protection.
>################################################# #######
>
>
>
>
>


-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 -
digital self defense, top technical experts, no vendor pitches,
unmatched networking opportunities. Visit www.blackhat.com
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users