[Snort-users] CIDR notation question

Matt Kettler mkettler at ...4108...
Thu Jul 10 14:27:07 EDT 2003

At 11:42 AM 7/10/2003 -0600, Rich Adamson wrote:
>Or, asking the question slightly different...
>   is var HOME_NET [,]
>     treated exactly the same as
>   HOME_NET []
>when packets are analyzed?

Logically, they should have the same effect. ie: they will be analyzed 
inclusive of network and broadcast addresses. However, the /23 version will 
run faster.

More information about the Snort-users mailing list