[Snort-users] Alerts generated by hosts on which snort is runnung
slacklist at ...9735...
Wed Sep 14 15:37:42 EDT 2005
At the beginning little description of my situation. I have linux
box with two interfaces. Eth0 - lan, eth1 - wan. I want snort to
watch attack only from the WAN.
I set up snort with definitions like below (in snort.conf):
var HOME_NET 83.17.xxx.xxx/30 # (my public subnetwork: my ip, ip
of DSL modem, network address and broadcast)
var EXTERNAL_NET !$HOME_NET
var SMTP_SERVERS 83.17.xxx.xxx
var HTTP_SERVERS 83.17.xxx.xxx
(rest of the conf file is, i think, default, without any strange
I start snort to listen on eth1.
The problem is, that when i'm inspecting ACID i see my own server as
a source of many "attacks", port scans, etc. Destinations of "these"
attack are often normal www sites, which lan users visits every day.
And this is my problem. How to set up these variables, so my snort
will detect only real attacks? FROM internet to my server, NOT form
my server to internet :)
Marcin, slacklist at ...9735...
More information about the Snort-users