[Snort-users] var HOME_NET under Linux

Erek Adams erek at ...950...
Sat Jun 28 12:25:07 EDT 2003


On Sat, 28 Jun 2003, Thomas Bechtold wrote:

> Ok, that works.
>
> Now I set the Variable HOME_NET in snort.conf to any:
> var HOME_NET = any
>
> and when i start snort, i set the parameter i(interface) to eth0:
> snort -c /etc/snort/snort.conf -i eth0

If you want to reduce your false postives, change your HOME_NET to:

	var HOME_NET $eth0_ADDRESS

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson




More information about the Snort-users mailing list