[Snort-users] external_net and home_net questions

thelupine thelupine at ...2198...
Sat Jun 1 19:24:03 EDT 2002


I've read somewhere in the archives that this is allowed:

var HOME_NET $eth0_ADDRESS
var EXTERNAL_NET !$HOME_NET

Is it?  If so, it is not working for me.  I have define EXTERNAL_NET as
ANY in order to get logs/alerts.  Any idea why?  Or is it not suppose to
work this way?

TIA, 
-Lup





More information about the Snort-users mailing list