[Snort-users] Snort IGNORES var HOME_NET

Matt Kettler mkettler at ...4108...
Fri May 3 08:49:05 EDT 2002

Hmm, what is your EXTERNAL_NET specified as? by default it is set to any, 
so until you change that, you will get alerts for home - to - home attacks.

At 09:18 AM 5/3/2002 +0000, counterping at ...5767... wrote:
>I am fairly new to the world of Snort and hopefully someone maybe able to 
>me out: (1.83 ver)
>I have set up several networks within the home_net variable under snort.conf
>However, SNORT seems to IGNORE these networks as my Home Networks and send
>alarms for HOME to HOME intrusions.
>For example,
>I am still seeing lots of alarms from my home network to my
> home network,
>If a particular rule specifies EXTERNAL_NET -> HOME_NET surely I should 
>NOT get
>alerted when the packet is sent from my home network to another home network ?
>i.e ----->
>Any help would be greatly appreciated
>This message was sent using                 http://uk2.net
>FREE UK DIAL 0845 609 1370 - username uk2: - password: uk2
>UK's FREE Domains, FREE Dialup, FREE Webdesign, FREE email
>Have big pipes? SourceForge.net is looking for download mirrors. We supply
>the hardware. You get the recognition. Email Us: bandwidth at ...382...
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>Snort-users list archive:

More information about the Snort-users mailing list