[Snort-users] Snort IGNORES var HOME_NET

Leonardo Alcantara Moreira leonardo at ...5737...
Fri May 3 10:09:07 EDT 2002

On Fri, 3 May 2002 09:18:53 GMT
<counterping at ...5767...> wrote:

> Hiya,
> I am fairly new to the world of Snort and hopefully someone maybe able to help 
> me out: (1.83 ver)
> I have set up several networks within the home_net variable under snort.conf
> var HOME_NET 
> [,,,,,192.1
> 68.20.0/24]
> However, SNORT seems to IGNORE these networks as my Home Networks and send 
> alarms for HOME to HOME intrusions.
> For example,
> I am still seeing lots of alarms from my home network to my 
> home network,
> If a particular rule specifies EXTERNAL_NET -> HOME_NET surely I should NOT get 
> alerted when the packet is sent from my home network to another home network ?
> i.e ----->
> Any help would be greatly appreciated

	What is your EXTERNAL_NET definition ??? Does it include this networks ???
Probably u left the default "any". And that means really ANY, including your home
nets. You should try !$HOME_NET as a safe bet.

      Best regards,

	Leonardo Alcantara

More information about the Snort-users mailing list