mkettler at ...4108...
Tue Apr 20 16:19:06 EDT 2004
At 03:05 PM 4/20/2004, Chuck Holley wrote:
>I have snort running, and I am impressed by it. I guess now I am trying to
>understand the conf. I understand what the variables do sort of. I would
>like to set variables for my DNS servers, SMTP, and Web. How do I do that
Um, edit your snort.conf so the DNS_SERVERS, SMTP_SERVERS and HTTP_SERVERS
variables to list the IP addresses of the servers you run. These default to
HOME_NET, but you can edit them in snort.conf.
> What does the external_net mean?? I guess I am looking for a sample
> conf with explanations of my options and what they mean. I am brand new
> to IDS, excuse my ignorance.
EXTERNAL_NET is just a variable used by many rules in the ruleset. Most of
the default ruleset looks for attacks which come from an IP address in
EXTERNAL_NET and go to HOME_NET. Others look for exploit responses going
the other way.
In general, EXTERNAL_NET should be set to whatever IP addresses you want to
monitor as potential sources of attack. "any" is a good starting point, but
!HOME_NET also has it's merits in that you save CPU time by not checking
packets generated by your own network as a source of attack.
However, what you want/need to monitor is very dependent on what kind of
network you run. For example, if you worked for a university, it might well
be that you would reverse the typical meanings of HOME and EXTERNAL and
monitor for attacks coming from your computer labs and being launched into
the rest of the world.
More information about the Snort-users