[Snort-users] Home_net & external_net

Jeremy Finke Jeremy.Finke at ...7343...
Fri Dec 6 06:29:04 EST 2002


Except that I want to view 192.168.41.0 as both an attacking and protected network.

	-----Original Message----- 
	From: Erek Adams [mailto:erek at ...577...] 
	Sent: Thu 12/5/2002 7:31 PM 
	To: Jeremy Finke 
	Cc: snort-users at lists.sourceforge.net 
	Subject: Re: [Snort-users] Home_net & external_net
	
	

	On Thu, 5 Dec 2002, Jeremy Finke wrote:
	
	> I have something that is driving me crazy.
	>
	> I have alerts going off from within two different segments of my
	> HOME_NET.  I don't understand why I am seeing these.  Here are the 2
	> lines from my snort.conf:
	>
	> var HOME_NET [192.168.40.0/24,192.168.41.0/24,10.14.0.0/16]
	> var EXTERNAL_NET [any,!192.168.40.0/24,!10.14.0.0/16]
	
	[...snip...]
	
	Make your life simple.
	
	        var HOME_NET [192.168.40.0/24,192.168.41.0/24,10.14.0.0/16]
	        var EXTERNAL_NET !$HOME_NET
	
	Cheers!
	
	
	-----
	Erek Adams
	Nifty-Type-Guy
	TheAdamsFamily.Net
	



More information about the Snort-users mailing list