[Snort-users] Noob question on snort.conf
michaels at ...9077...
Sat May 31 20:56:09 EDT 2003
You need to read the Snort documentation and take each one at a time.
If you have:
var HOME_NET 172.16.0.1/30
and remove the hash mark from this next line:
var HTTP_SERVERS $HOME_NET
The above line will translate with no changes, to:
var HTTP_SERVERS 172.16.0.1/30
System Engineer / Security Support Technician
mailto:michaels at ...9077...
Snort: Open Source Network IDS - http://www.snort.org
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of storm
Sent: Saturday, June 01, 2002 7:59 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Noob question on snort.conf
Hi everyone. Need a little help with snort.conf editing.
i ucommented the line that says:
#You can specify it explicity as:
#var HOME_NET 10.1.1.0/24
#or use global variable etc etc
and I commented it to:
#var HOME_NET 172.16.0.1/30
Is this all I have to do to set HOME_NET? I notice there were a bunch of
other things you could comment that were related to HOME_NET. Is what I did
Also, where it asks you to list the servers on your network like this:
#var HTTP_SERVERS $HOME_NET
Where do I put the ip of the webserver? I suppose where it says
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users