[Snort-users] Subnetmask with option <device>_ADDRESS

Fritjof Heyde wusel51 at ...348...
Thu Mar 28 09:53:05 EST 2002

Hello List,

I wrote earlier that I had a problem with setting my homenet with the 
command line option -h <device>_ADDRESS.
Result was, that I dont get any alarms anymore.

I think I figured out why this is happening.

The IP and Netmask of  my device (ppp0) is set by my ISP.
And for what reason ever they use the Netmask
Which is as I recall the loopback device.
So the Netmask basicly doenst have any IP adresses!

Good one! :)

In the FAQ it says, that option <device>_ADDRESS animates snort to get 
the IP and the netmask automatically from that device.
Is there a way to set the Netmask manually even if I use the -h 
<device>_ADDRESS option?

I actually dont know if that would solve the problem, but its worth a 
try! :)

Anybody has some hints?


More information about the Snort-users mailing list