<html><body><div style="color:#000; background-color:#fff; font-family:bookman old style, new york, times, serif;font-size:16px">i try to use cdx dataset(<a class="" id="yui_3_16_0_1_1440071547859_3316" href="http://www.usma.edu/crc/SitePages/DataSets.aspx" target="_blank" rel="nofollow">http://www.usma.edu/<wbr class="" id="yui_3_16_0_1_1440071547859_3318">crc/SitePages/DataSets.aspx</a>)<br class="" id="yui_3_16_0_1_1440071547859_3320">they mention that used NAT(network address translation) in their network.<br class="" id="yui_3_16_0_1_1440071547859_3322"><div id="yui_3_16_0_1_1440071547859_3343" dir="ltr">their network topology is here:(<a class="" id="yui_3_16_0_1_1440071547859_3324" href="http://www.usma.edu/crc/SiteAssets/SitePages/DataSets/CDX_2009_Network_USMA.pdf" target="_blank" rel="nofollow">http://www.usma.edu/crc/<wbr class="" id="yui_3_16_0_1_1440071547859_3326">SiteAssets/SitePages/DataSets/<wbr class="" id="yui_3_16_0_1_1440071547859_3328">CDX_2009_Network_USMA.pdf</a>)i
 mix how configure HOME_NET variable in snort.conf?  should i use 
internal address or external address? they deliver a snort alert output 
file(<a class="" id="yui_3_16_0_1_1440071547859_3330" href="https://drive.google.com/open?id=0B0u9Tg7udaAXd3dZVGRVWWJ1ZW8&authuser=0" target="_blank" rel="nofollow">https://drive.google.com/<wbr class="" id="yui_3_16_0_1_1440071547859_3332">open?id=<wbr class="" id="yui_3_16_0_1_1440071547859_3334">0B0u9Tg7udaAXd3dZVGRVWWJ1ZW8&<wbr class="" id="yui_3_16_0_1_1440071547859_3336">authuser=0</a>),
 but addresses in this file is different from my SO generated alert 
file. please help me how configure HOME & EXternal ip address in 
snort.conf for using this dataset</div><div id="yui_3_16_0_1_1440071547859_3308"><span></span></div><div id="yui_3_16_0_1_1440071547859_3306"> </div><div id="yui_3_16_0_1_1440071547859_3304" class="signature">Sincerely yours
 Mahdi Maleki</div></div></body></html>