[Snort-users] Network Variables
jthoel at ...11827...
Tue Apr 30 17:37:57 EDT 2013
well snort reads a text file that contains the bpf filters.
I don't use snort in windows, but the same path structure that you use
to point to your rules, point to a text file containing the bpf filter
you want to run against.
On Tue, Apr 30, 2013 at 5:19 PM, Seth Dunn <seth at ...16266...> wrote:
> Thank you for the confirmation.
> Do you know how to set up bpf filters under windows?
> I would like to go that route so I can fine tune things vs. just
> blocking out entire IP ranges.
> But I have had no luck getting that to work.
> -----Original Message-----
> From: Jeremy Hoel [mailto:jthoel at ...11827...]
> Sent: Tuesday, April 30, 2013 11:26 AM
> To: Seth Dunn
> Cc: snort-users at lists.sourceforge.net
> Subject: Re: [Snort-users] Network Variables
> Yes.. since you are only negating some ip's, the rest that match will
> On Tue, Apr 30, 2013 at 3:04 PM, Seth Dunn <seth at ...16266...> wrote:
>> Ok, I think I got it corrected.
>> I altered my EXTERNEL_NET variable to ::
>> [!10.30.0.0/24,!10.10.0.0/24] That seems to have stopped the
>> false-positives, while still logging other traffic.
>> So I am assuming there is a default "any" aspect to this variable.
>> From: Seth Dunn [mailto:seth at ...16266...]
>> Sent: Monday, April 29, 2013 10:23 AM
>> To: snort-users at lists.sourceforge.net
>> Subject: [Snort-users] Network Variables
>> I am running Snort on Windows 2008 Server R2
>> I am trying to figure out how I can bypass traffic that is being sent
>> from certain networks, since it is creating false-positives
>> Information on my setup.
>> My watched networks are:: 10.75.x.x/24 and 10.76.x.x/24 Now I also
>> have two other networks, that are not being watched, but are part of
>> my companies network and setup.
>> They are:: 10.10.x.x/24 <- Office network
>> 10.30.x.x/24 <- Remote VPN users
>> Originally I tried putting in a .bpf file, but that did not work.
>> (anyone know how to make it work?)
>> So I tried my HOME_NET like this::
>> That didn't work, snort still sent out alerts for the two networks.
>> So I put HOME_NET back to :: [10.75.0.0/16,10.76.0.0/16] And set
>> EXTERNAL_NET to this:: [any, !10.10.0.0/24,!10.30.0.0/24], that did
>> not work So I tried:: [any, [!10.10.0.0/24,10.30.0.0/24]], that did
>> not work
>> Any ideas on what I can do to fix this?
>> My networks 10.75.x.x and 10.76.x.x are connected to the networks
>> 10.10.x.x and 10.30.x.x via two Cisco PIX 515E's
>> -------- Introducing AppDynamics Lite, a free troubleshooting tool for
>> Java/.NET Get 100% visibility into your production application - at no
>> Code-level diagnostics for performance bottlenecks with <2% overhead
>> Download for free and get started troubleshooting in minutes.
>> Snort-users mailing list
>> Snort-users at lists.sourceforge.net
>> Go to this URL to change user options or unsubscribe:
>> Snort-users list archive:
>> Please visit http://blog.snort.org to stay current on all the latest
>> Snort news!
More information about the Snort-users