[Snort-users] snort.conf

Matt Kettler mkettler at ...4108...
Tue Apr 20 16:19:06 EDT 2004

At 03:05 PM 4/20/2004, Chuck Holley wrote:
>I have snort running, and I am impressed by it. I guess now I am trying to 
>understand the conf.  I understand what the variables do sort of.  I would 
>like to set variables for my DNS servers, SMTP, and Web.  How do I do that 

Um, edit your snort.conf so the DNS_SERVERS, SMTP_SERVERS and HTTP_SERVERS 
variables to list the IP addresses of the servers you run. These default to 
HOME_NET, but you can edit them in snort.conf.

>  What does the external_net mean??  I guess I am looking for a sample 
> conf with explanations of my options and what they mean.  I am brand new 
> to IDS, excuse my ignorance.

EXTERNAL_NET is just a variable used by many rules in the ruleset. Most of 
the default ruleset looks for attacks which come from an IP address in 
EXTERNAL_NET and go to HOME_NET. Others look for exploit responses going 
the other way.

In general, EXTERNAL_NET should be set to whatever IP addresses you want to 
monitor as potential sources of attack. "any" is a good starting point, but 
!HOME_NET also has it's merits in that you save CPU time by not checking 
packets generated by your own network as a source of attack.

However, what you want/need to monitor is very dependent on what kind of 
network you run. For example, if you worked for a university, it might well 
be that you would reverse the typical meanings of HOME and EXTERNAL and 
monitor for attacks coming from your computer labs and being launched into 
the rest of the world.

More information about the Snort-users mailing list