[Snort-users] Snort doesnt detect traffic.

Erek Adams erek at ...577...
Wed May 29 10:58:04 EDT 2002

On Wed, 29 May 2002 Magnus.M.Glantz at ...3584... wrote:


> Will there be any problems detecting alerts?
> I noticed that you have to define a HOME_NET and EXTERNAL_NET..
> But, for me, it's the same.
> I defined HOME_NET to and EXTERNAL_NET to Any
> I've also tried to do vice versa and define to both....


> pretty ascii:

Ummmm...  Not quite pretty...  :-/  But I can guess the issue.

> other net---mssql----     Hub     ----Snort
>                                   |       |     |
>                              box1 box2 box3
>                                |         |       |
>                                   Internet



I'm going to guess that's what your problem is.  If you have all of your
devices working at the same speed, then it will work as you expect.  Mixed bag
of 10/100 and you only see that type of traffic.

Try changing out your hub to a 'dumb' hub and see if that helps.

Cheers!  Oh--And one penalty drink.  ;-)

Erek Adams

More information about the Snort-users mailing list