erek at ...950...
Tue Apr 8 07:22:04 EDT 2003
On Mon, 7 Apr 2003, Keg wrote:
> 1. I get it., but on the other hand my EXTERNAL_NET is set to ANY.
> Should that treat nessus box as external_net?
If you run Snort in sniffer mode, can you see traffic destined for the
> 2. Should I always use EXTERNAL_NET as !$HOME_NET?
That's up to you. I do it to cut down on false positives. Try it both
ways and see what works better for you.
"When things get weird, the weird turn pro." H.S. Thompson
More information about the Snort-users