[Snort-users] CIDR notation question

Rich Adamson radamson at ...2127...
Thu Jul 10 11:45:38 EDT 2003

A couple of us are having a discuss off list.  Does anyone know (for a 
fact) how snort treats CIDR notation?

var HOME_NET [] implies 512 addresses, one broadcast
address (, and is a valid device address.

Is there any code that would assume natural subnet masks, or, analyze
packets in such a way as to assume is treated differently?

Or, asking the question slightly different...
  is var HOME_NET [,]
    treated exactly the same as
when packets are analyzed?


More information about the Snort-users mailing list