Bug 4771

I hope this patch should fix described problem.
Update in Sisyphus (snort-2.2.0-alt2) will be available very soon ;-)
--- /etc/rc.d/init.d/snortd.orig	2004-08-25 04:32:43 +0400
+++ /etc/rc.d/init.d/snortd	2004-08-27 04:14:44 +0400
@@ -16,6 +16,13 @@
 # Source function library.
 . /etc/init.d/functions
 
+# Testing tricks.
+if [ "$1" = "--trace-script" ]; then
+    shift
+    echo Enable script tracing...
+    set -x
+fi
+
 # Get config.
 CONFIG=/etc/sysconfig/snort
 SourceIfNotEmpty "$CONFIG" || exit 0
@@ -24,19 +31,39 @@
 
 [ -n "$INTERFACES" ] || exit 0
 
-IFN=`echo $INTERFACES | sed -e 's/, */ /g' | awk '{split($0, iface); {for (i in 
iface) {print $i;}}}'`
+function print_all_ifaces() {
+    local linenum=0
+    netstat -i | egrep -v '^lo' | while read first_word unused_tail; do
+	: $[linenum++]
+	case $linenum in
+	    1 | 2 ) ;;
+	    * ) echo $first_word ;;
+	esac
+    done
+}
+
+IFN=`echo $INTERFACES | sed -e 's/, */ /g'`
+case "$IFN" in
+    "" | any | all | Any | All | ANY | ALL ) IFN=`print_all_ifaces` ;;
+esac
 
 start()
 {
+    local add_params
     for i in $IFN; do
 	PIDFILE=/var/run/snort_$i.pid
 	LOCKFILE=/var/lock/subsys/snort_$i
+	for suffix in $i any all Any All ANY ALL; do
+	    eval add_params=\$ADDPARAMS_$suffix
+	    test -n "$add_params" && break
+	done
 	start_daemon --pidfile "$PIDFILE" \
 	    --lockfile "$LOCKFILE" \
 	    --expect-user snort -- \
 	    snort -u snort -g snort \
 	    -t /var/log/snort \
-	    $(eval echo $(echo \$`echo ADDPARAMS_$i`))
+	    -i $i \
+	    $add_params
 	RETVAL=$?
 	if [ $RETVAL != 0 ]; then
 	    return $RETVAL

re

apparently fixed :)