[Snort-users] newbie configuration issues

Paul Greene pauljgreene at ...5068...
Wed Jul 24 19:22:02 EDT 2002

At 10:14 PM 7/23/2002 -0700, John Sage wrote:

>How do you have $HOME_NET and $EXTERNAL_NET set?

Maybe it would be good to work out this $HOME_NET and $EXTERNAL_NET aspect 
first before getting into more esoteric stuff.

In snort.conf, I've tried changing the line:

"var HOME_NET any"

to "var HOME_NET [,64.48.xxx.xxx]"

(note the second is a single IP address; I don't want the rest of my ISP to 
be considered part of my home network)

How do you set the EXTERNAL_NET to be <anything other than HOME_NET>?

>/* somehow I'm having a hard time picturing this: the modem and
>the "IDS bridge" are just acting as though they're wire: packets just
>pass through with their IP addresses unexamined? */

Yes and no. The packets pass through like a wire, but snort (is supposed 
to) examines every single packet going by.


More information about the Snort-users mailing list