[Snort-users] two networks

Martin Roesch roesch at ...421...
Thu Jan 18 23:51:41 EST 2001


Think of it this way:

var HOME_NET <defended network>
var EXTERNAL_NET <everyone else>

Typically these variables are setup like this:

var HOME_NET 10.1.1.0/24
var EXTERNAL_NET !$HOME_NET


   -Marty


Rick Francis wrote:
> 
> var HOME_NET <inside interface>
> var EXTERNAL_NET <outside interface>
> 
> is this valid in latest-lib?
> if so, will logging of both _NET's go to the same directory/file??
> 
> if not, is snort just simply not built to monitor all interfaces on a
> system, or all networks on one system?
> 
> rf
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users

--
Martin Roesch
roesch at ...421...
http://www.snort.org




More information about the Snort-users mailing list