[Snort-users] HOME_NET strangeness

James Pattinson jamesp at ...1686...
Wed Mar 28 14:07:10 EST 2001


Hi

$HOME_NET is set to my network, 193.195.220.112/28.
(my netmask is 255.255.255.240)

However, I still get alerts for activity within my local net, ie:

03/28-20:03:22.616533  [**] IDS126 - Outgoing Xterm [**]
193.195.220.121:6000 -> 193.195.220.114:35814

How can I fix this? the rule for this alert specifies
$EXTERNAL_NET 6000:6005 -> $HOME_NET

and the alert clearly relates to HOME_NET --> HOME_NET.

Help!

:)

James





More information about the Snort-users mailing list