[Snort-users] Snort IGNORES var HOME_NET

counterping at ...5767... counterping at ...5767...
Fri May 3 01:12:04 EDT 2002


Hiya,

I am fairly new to the world of Snort and hopefully someone maybe able to help 
me out: (1.83 ver)

I have set up several networks within the home_net variable under snort.conf
var HOME_NET 
[64.6.189.0/24,172.16.10.0/24,10.10.60.10/24,10.10.30.0/16,192.168.10.0/24,192.1
68.20.0/24]

However, SNORT seems to IGNORE these networks as my Home Networks and send 
alarms for HOME to HOME intrusions.

For example,
I am still seeing lots of alarms from my 172.16.10.0 home network to my 
10.10.30.0 home network,
If a particular rule specifies EXTERNAL_NET -> HOME_NET surely I should NOT get 
alerted when the packet is sent from my home network to another home network ?
i.e 172.16.10.35 -----> 10.10.30.10

Any help would be greatly appreciated

Martin

----------------------------------------------------------
This message was sent using                 http://uk2.net
NEWS - CHEAPEST DEDICATED SERVERS IN THE WORLD -  25/month
FREE UK DIAL 0845 609 1370 - username uk2: - password: uk2
UK's FREE Domains, FREE Dialup, FREE Webdesign, FREE email






More information about the Snort-users mailing list