[Snort-users] a lot of Loopback traffic being logged.
mkettler at ...4108...
Thu Apr 22 10:29:05 EDT 2004
At 12:58 PM 4/22/2004, Chuck Holley wrote:
>OK, I think im on to something. I do not use the -i option, only -c to look
>at the conf. in the conf I have for "HOME_NET 192.168.10.0/24" and a little
>further down I have "HOME_NET any"
>I didn't pay much attention to that earlier because they were both not
>commented out by default. Im still a little confused on how snort works. Is
>this the problem?
No, it's not a problem, If I remember correctly the duplicate definition
will just cause the second one to be used.
However HOME_NET has nothing to do with what traffic snort picks up.
HOME_NET is basically just a variable that get's substituted in various
places in the rules and parameters to the preprocessors. It's used to give
rules/code hints as to which end of a conversation is likely to be a part
of your network. HOME_NET changes the alerting behaviors of snort, but
doesn't change the low-level packet collection behaviors.
Things like -i tell snort which network interface to suck traffic in from.
This is a very low-level thing and changes what packets enter snort in the
More information about the Snort-users