[Snort-users] CIDR notation question

Matt Kettler mkettler at ...4108...
Thu Jul 10 14:27:07 EDT 2003


At 11:42 AM 7/10/2003 -0600, Rich Adamson wrote:
>Or, asking the question slightly different...
>   is var HOME_NET [172.16.0.0/24,172.16.1.0/24]
>     treated exactly the same as
>   HOME_NET [172.16.0.0/23]
>when packets are analyzed?

Logically, they should have the same effect. ie: they will be analyzed 
inclusive of network and broadcast addresses. However, the /23 version will 
run faster.






More information about the Snort-users mailing list