[Snort-users] HOME_NET strangeness

James Pattinson jamesp at ...1686...
Wed Mar 28 14:07:10 EST 2001


$HOME_NET is set to my network,
(my netmask is

However, I still get alerts for activity within my local net, ie:

03/28-20:03:22.616533  [**] IDS126 - Outgoing Xterm [**] ->

How can I fix this? the rule for this alert specifies
$EXTERNAL_NET 6000:6005 -> $HOME_NET

and the alert clearly relates to HOME_NET --> HOME_NET.




More information about the Snort-users mailing list