[Snort-users] $HOME_NET

Erek Adams erek at ...950...
Tue Apr 8 07:22:04 EDT 2003

On Mon, 7 Apr 2003, Keg wrote:

> 1. I get it., but on the other hand my EXTERNAL_NET is set to ANY.
> Should that  treat nessus box as external_net?

It should.

If you run Snort in sniffer mode, can you see traffic destined for the
Win32 box?

	snort -vd

> 2. Should I always use EXTERNAL_NET as !$HOME_NET?

That's up to you.  I do it to cut down on false positives.  Try it both
ways and see what works better for you.

Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson

More information about the Snort-users mailing list