[Snort-users] subnets and rules

Martin Roesch roesch at ...421...
Mon Oct 2 15:44:36 EDT 2000


I'm pretty sure that that will convert to "any".  The built in keyword for
"any" is, in fact, "any". :)

    -Marty

John Tran wrote:
> 
> While reading through the rules.cfg, the section that states :
> 
>  CHANGE THE NEXT LINE TO REFLECT YOUR NETWORK
> # (Single system = 0.0.0.0/0)
> var HOME_NET 0.0.0.0/0
> 
> Says that the 0.0.0.0/0 subnet is for a single system?  Shouldn't that subnet specify EVERYTHING and not a single system?  If I'm incorrect, what is the correct way for specifying "EVERYTHING"?
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> http://lists.sourceforge.net/mailman/listinfo/snort-users

-- 
Martin Roesch
roesch at ...421...
http://www.snort.org



More information about the Snort-users mailing list