[Snort-users] newbie configuration issues
pauljgreene at ...5068...
Wed Jul 24 19:22:02 EDT 2002
At 10:14 PM 7/23/2002 -0700, John Sage wrote:
>How do you have $HOME_NET and $EXTERNAL_NET set?
Maybe it would be good to work out this $HOME_NET and $EXTERNAL_NET aspect
first before getting into more esoteric stuff.
In snort.conf, I've tried changing the line:
"var HOME_NET any"
to "var HOME_NET [192.168.0.0/24,64.48.xxx.xxx]"
(note the second is a single IP address; I don't want the rest of my ISP to
be considered part of my home network)
How do you set the EXTERNAL_NET to be <anything other than HOME_NET>?
>/* somehow I'm having a hard time picturing this: the modem and
>the "IDS bridge" are just acting as though they're wire: packets just
>pass through with their IP addresses unexamined? */
Yes and no. The packets pass through like a wire, but snort (is supposed
to) examines every single packet going by.
More information about the Snort-users