[Snort-users] $HOME_NET

Erek Adams erek at ...950...
Tue Apr 8 07:22:04 EDT 2003


On Mon, 7 Apr 2003, Keg wrote:

> 1. I get it., but on the other hand my EXTERNAL_NET is set to ANY.
> Should that  treat nessus box as external_net?

It should.

If you run Snort in sniffer mode, can you see traffic destined for the
Win32 box?

	snort -vd

> 2. Should I always use EXTERNAL_NET as !$HOME_NET?

That's up to you.  I do it to cut down on false positives.  Try it both
ways and see what works better for you.

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson




More information about the Snort-users mailing list