[Snort-users] Home_net & external_net
Jeremy.Finke at ...7343...
Fri Dec 6 06:29:04 EST 2002
Except that I want to view 192.168.41.0 as both an attacking and protected network.
From: Erek Adams [mailto:erek at ...577...]
Sent: Thu 12/5/2002 7:31 PM
To: Jeremy Finke
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Home_net & external_net
On Thu, 5 Dec 2002, Jeremy Finke wrote:
> I have something that is driving me crazy.
> I have alerts going off from within two different segments of my
> HOME_NET. I don't understand why I am seeing these. Here are the 2
> lines from my snort.conf:
> var HOME_NET [192.168.40.0/24,192.168.41.0/24,10.14.0.0/16]
> var EXTERNAL_NET [any,!192.168.40.0/24,!10.14.0.0/16]
Make your life simple.
var HOME_NET [192.168.40.0/24,192.168.41.0/24,10.14.0.0/16]
var EXTERNAL_NET !$HOME_NET
More information about the Snort-users