[Snort-users] home_net

John Sage jsage at ...2022...
Fri Mar 8 10:29:05 EST 2002

On Fri, Mar 08, 2002 at 12:30:43PM -0500, Basil Saragoza wrote:
> When I set home_net in snort.conf to ip address of my firewall everything is
> fine.
> When I set it to then I see onl;y ICMP traffic.....
> (external_net set to any)
> Any reason for such behaviour on snort?
> What is the correlation between home_net and external_net?

Several thoughts:

1) I would **never** actually post a live IP address, or IP address
range to a mail list -- obfuscate it -- we don't need to know the
actual IP address you've got to work with, and neither does anyone

2) corresponds to this:

Address:       11010111.01111100.10101111.10 000100
Netmask: == 26 11111111.11111111.11111111.11 000000
Network:    11010111.01111100.10101111.10 000000 (Class C)
Broadcast:       11010111.01111100.10101111.10 111111
HostMin:       11010111.01111100.10101111.10 000001
HostMax:       11010111.01111100.10101111.10 111110
Hosts/Net: 62 

the (useable) netblock from HostMin: to a HostMax: for a total of 62 hosts.

Is this what you're intending to do?

I have no idea as to why this (the *only*..?) change would suddenly
result in your seeing only icmp traffic.

Is this the only change you've made?

- John
Most people don't type their own logfiles;  but, what do I care?

More information about the Snort-users mailing list