[Snort-users] Does setting HOME_NET have any effect in Stealth mode?

Michael Boman michael.boman at ...11827...
Tue Nov 2 07:08:10 EST 2004


On Tue, 02 Nov 2004 13:05:26 +0000, Rob Ward <rob.ward at ...11329...> wrote:
> When I set "HOME_NET" to anything other than 'any' I no longer see any DOS
> or DDOS alerts but P2P alerts are still output. I've tried following the
> configuration examples in the FAQ's etc and can't get it to work. I'm
> wondering if HOME_NET has any relevance when running snort in 'stealth' or
> am I wide of the mark?

HOME_NET is used to define the network you are interesting to monitor,
and your snort box being in stealth mode or not has nothing to do with
it.

> Also - can snort cope with variable length subnet masks?

Please explain what you mean.

Best regards
 Michael Boman




More information about the Snort-users mailing list