[Snort-users] HOME_NET Clarification

Ilango S Allikuzhi IlangoAllikuzhi at ...12241...
Fri Nov 19 10:42:01 EST 2004


I can not enter [10.0.0.0/8] as some subnets are to be considered external 
- for instance 10.40.2.0/24 is external
I would like to exclude these subnets.
Thanks,
Ilango




"Esler, Joel - Contractor" <joel.esler at ...9426...>
10/29/2004 02:45 PM

 
        To:     Ilango S Allikuzhi <IlangoAllikuzhi at ...12241...>, 
<snort-users at lists.sourceforge.net>
        cc: 
        Subject:        RE: [Snort-users] HOME_NET Clarification


Enter the ones you want to be internal (in your below example [10.0.0.0/8, 
192.168.1.0/24]  all others will be specified as External_net if you have 
External_net defined as any.
 
J
-----Original Message-----
From: snort-users-admin at lists.sourceforge.net 
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Ilango S Allikuzhi
Sent: Friday, October 22, 2004 12:25 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] HOME_NET Clarification


Is it possible to define HOME_NET as [!10.40.1.0/24, !10.40.2.0/24, 
10.0.0.0/8, 192.168.1.0/24]  for instance? 
In other words, we want all subnets under 10 except a few. 
Some public addresses get NAT'ed to 10.40.2.x addresses and hence I need 
to treat them as external net. 
Thanks, 
Ilango 



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20041119/2c10ea35/attachment.html>


More information about the Snort-users mailing list