[Snort-users] a lot of Loopback traffic being logged.

Matt Kettler mkettler at ...4108...
Thu Apr 22 10:29:05 EDT 2004

At 12:58 PM 4/22/2004, Chuck Holley wrote:
>OK, I think im on to something.  I do not use the -i option, only -c to look
>at the conf.  in the conf I have for "HOME_NET" and a little
>further down I have "HOME_NET any"
>I didn't pay much attention to that earlier because they were both not
>commented out by default.  Im still a little confused on how snort works. Is
>this the problem?

No, it's not a problem, If I remember correctly the duplicate definition 
will just cause the second one to be used.

However HOME_NET has nothing to do with what traffic snort picks up. 
HOME_NET is basically just a variable that get's substituted in various 
places in the rules and parameters to the preprocessors. It's used to give 
rules/code hints as to which end of a conversation is likely to be a part 
of your network. HOME_NET changes the alerting behaviors of snort, but 
doesn't change the low-level packet collection behaviors.

Things like -i tell snort which network interface to suck traffic in from. 
This is a very low-level thing and changes what packets enter snort in the 
first place.

More information about the Snort-users mailing list