[Snort-users] Multiple HOME_NET IP's

Andy Beal abeal at ...316...
Fri Aug 11 14:19:59 EDT 2000


If this works, it's the cleanest solution.....I see no reason why it wouldn't, only downside is doubling the size of the rules.    Thanks.

Andy

>>> Daniel van Balen <vdaniel at ...191...> 08/11/00 04:58AM >>>
On Fri, Aug 11, 2000 at 12:04:41PM -0500, Andy Beal wrote:
> Greetings,
> 
> How about 2 Completely different HOME_NET subnets, such as   192.168.0.0/24 and 10.0.0.0/8, how would I get this done?   Will some sort of Boolean And work inside the variable, it seems that the rules will/should interpret correctly, but I could be wrong.   
> 
> 

	This is what you want:

var HOME_NET 192.168.0.0/24
include <the rule file>
var HOME_NET 10.0.0.0/8
include <the rule file>
... and so on and so forth...


-spiff


_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net 
http://lists.sourceforge.net/mailman/listinfo/snort-users





More information about the Snort-users mailing list