[Snort-users] Subnetmask with option <device>_ADDRESS

Fritjof Heyde wusel51 at ...348...
Thu Mar 28 09:53:05 EST 2002


Hello List,

I wrote earlier that I had a problem with setting my homenet with the 
command line option -h <device>_ADDRESS.
Result was, that I dont get any alarms anymore.

Ok!
I think I figured out why this is happening.

The IP and Netmask of  my device (ppp0) is set by my ISP.
And for what reason ever they use the Netmask 255.255.255.255
Which is as I recall the loopback device.
So the Netmask basicly doenst have any IP adresses!

Good one! :)

In the FAQ it says, that option <device>_ADDRESS animates snort to get 
the IP and the netmask automatically from that device.
Is there a way to set the Netmask manually even if I use the -h 
<device>_ADDRESS option?

I actually dont know if that would solve the problem, but its worth a 
try! :)

Anybody has some hints?

greets
Fritjof






More information about the Snort-users mailing list