[Snort-users] Configuring snort.conf
erek at ...950...
Wed Feb 11 07:22:09 EST 2004
On Tue, 10 Feb 2004, James Chong wrote:
> The examples given uses a network ID followed by a
> subnet mask.
> Say I only want to monitor certain IP addresses using
> snort.Can I do this? How should I write it?
> Say I want to monitor only certain IP addresses on my
> network: 188.8.131.52-184.108.40.206
> Net ID:220.127.116.11/27
> To monitor the whole network I would use:
> var HOME_NET 18.104.22.168/27 but I do not want
> Should it be:
> var HOME_NET 22.214.171.124-126.96.36.199 then?
var HOME_NET [188.8.131.52/32,184.108.40.206/32,220.127.116.11/32,18.104.22.168/32,22.214.171.124/32]
Or to clean that up a bit, you might want to use:
var HOME_NET 126.96.36.199/29
That'll get you .160-.166.
"It looks just like a Telefunken U-47. You'll love it..." -- Frank Zappa
More information about the Snort-users