[Snort-users] Network Variables
seth at ...16266...
Tue Apr 30 13:19:28 EDT 2013
Thank you for the confirmation.
Do you know how to set up bpf filters under windows?
I would like to go that route so I can fine tune things vs. just
blocking out entire IP ranges.
But I have had no luck getting that to work.
From: Jeremy Hoel [mailto:jthoel at ...11827...]
Sent: Tuesday, April 30, 2013 11:26 AM
To: Seth Dunn
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Network Variables
Yes.. since you are only negating some ip's, the rest that match will
On Tue, Apr 30, 2013 at 3:04 PM, Seth Dunn <seth at ...16266...> wrote:
> Ok, I think I got it corrected.
> I altered my EXTERNEL_NET variable to ::
> [!10.30.0.0/24,!10.10.0.0/24] That seems to have stopped the
> false-positives, while still logging other traffic.
> So I am assuming there is a default "any" aspect to this variable.
> From: Seth Dunn [mailto:seth at ...16266...]
> Sent: Monday, April 29, 2013 10:23 AM
> To: snort-users at lists.sourceforge.net
> Subject: [Snort-users] Network Variables
> I am running Snort on Windows 2008 Server R2
> I am trying to figure out how I can bypass traffic that is being sent
> from certain networks, since it is creating false-positives
> Information on my setup.
> My watched networks are:: 10.75.x.x/24 and 10.76.x.x/24 Now I also
> have two other networks, that are not being watched, but are part of
> my companies network and setup.
> They are:: 10.10.x.x/24 <- Office network
> 10.30.x.x/24 <- Remote VPN users
> Originally I tried putting in a .bpf file, but that did not work.
> (anyone know how to make it work?)
> So I tried my HOME_NET like this::
> That didn't work, snort still sent out alerts for the two networks.
> So I put HOME_NET back to :: [10.75.0.0/16,10.76.0.0/16] And set
> EXTERNAL_NET to this:: [any, !10.10.0.0/24,!10.30.0.0/24], that did
> not work So I tried:: [any, [!10.10.0.0/24,10.30.0.0/24]], that did
> not work
> Any ideas on what I can do to fix this?
> My networks 10.75.x.x and 10.76.x.x are connected to the networks
> 10.10.x.x and 10.30.x.x via two Cisco PIX 515E's
> -------- Introducing AppDynamics Lite, a free troubleshooting tool for
> Java/.NET Get 100% visibility into your production application - at no
> Code-level diagnostics for performance bottlenecks with <2% overhead
> Download for free and get started troubleshooting in minutes.
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> Snort-users list archive:
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
More information about the Snort-users