[Snort-users] Snort IGNORES var HOME_NET

Ryan Hill rhill at ...2446...
Fri May 3 10:10:04 EDT 2002


I'm no snort expert by any means, but

var EXTERNAL_NET !$HOME_NET

(! meaning not equal to) should solve your problems. ;)

Regards,

Ryan Hill
Corporate Information Systems
TeleCommunication Systems, Inc. (TCS) - http://www.telecomsys.com


> >However, SNORT seems to IGNORE these networks as my Home 
> Networks and send
> >alarms for HOME to HOME intrusions.




More information about the Snort-users mailing list