[Snort-users] HOME_NET Clarification

Esler, Joel - Contractor joel.esler at ...9426...
Fri Oct 29 11:47:06 EDT 2004


Enter the ones you want to be internal (in your below example
[10.0.0.0/8, 192.168.1.0/24]  all others will be specified as
External_net if you have External_net defined as any.
 
J

-----Original Message-----
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Ilango S
Allikuzhi
Sent: Friday, October 22, 2004 12:25 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] HOME_NET Clarification



Is it possible to define HOME_NET as [!10.40.1.0/24, !10.40.2.0/24,
10.0.0.0/8, 192.168.1.0/24]  for instance? 
In other words, we want all subnets under 10 except a few. 
Some public addresses get NAT'ed to 10.40.2.x addresses and hence I need
to treat them as external net. 
Thanks, 
Ilango 



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20041029/11f84cc6/attachment.html>


More information about the Snort-users mailing list