[Snort-users] Network Variables

Seth Dunn seth at ...16266...
Tue Apr 30 19:28:28 EDT 2013


Right, and I set up the text file, and snort started and read the file.
But it didn't filter out the traffic.
And I have followed the examples I have seen creating the file, but it
is not working as expected.

-----Original Message-----
From: Jeremy Hoel [mailto:jthoel at ...11827...] 
Sent: Tuesday, April 30, 2013 5:38 PM
To: Seth Dunn
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Network Variables

well snort reads a text file that contains the bpf filters.

I don't use snort in windows, but the same path structure that you use
to point to your rules, point to a text file containing the bpf filter
you want to run against.



On Tue, Apr 30, 2013 at 5:19 PM, Seth Dunn <seth at ...16266...> wrote:
> Great.
> Thank you for the confirmation.
>
> Do you know how to set up bpf filters under windows?
> I would like to go that route so I can fine tune things vs. just 
> blocking out entire IP ranges.
> But I have had no luck getting that to work.
>
> -----Original Message-----
> From: Jeremy Hoel [mailto:jthoel at ...11827...]
> Sent: Tuesday, April 30, 2013 11:26 AM
> To: Seth Dunn
> Cc: snort-users at lists.sourceforge.net
> Subject: Re: [Snort-users] Network Variables
>
> Yes..   since you are only negating some ip's, the rest that match
will
> work.
>
> On Tue, Apr 30, 2013 at 3:04 PM, Seth Dunn <seth at ...16266...> wrote:
>> Ok, I think I got it corrected.
>> I altered my EXTERNEL_NET variable to ::
>> [!10.30.0.0/24,!10.10.0.0/24] That seems to have stopped the 
>> false-positives, while still logging other traffic.
>> So I am assuming there is a default "any" aspect to this variable.
>>
>>
>>
>> From: Seth Dunn [mailto:seth at ...16266...]
>> Sent: Monday, April 29, 2013 10:23 AM
>> To: snort-users at lists.sourceforge.net
>> Subject: [Snort-users] Network Variables
>>
>>
>>
>> Hello,
>> I am running Snort on Windows 2008 Server R2
>>
>> I am trying to figure out how I can bypass traffic that is being sent

>> from certain networks, since it is creating false-positives
>>
>> Information on my setup.
>> My watched networks are:: 10.75.x.x/24 and 10.76.x.x/24 Now I also 
>> have two other networks, that are not being watched, but are part of 
>> my companies network and setup.
>> They are:: 10.10.x.x/24 <- Office network
>> 10.30.x.x/24 <- Remote VPN users
>>
>> Originally I tried putting in a .bpf file, but that did not work.
>> (anyone know how to make it work?)
>>
>>
>> So I tried my HOME_NET like this::
>> [10.75.0.0/16,10.76.0.0/16,!10.10.0.0/24,!10.30.0.0/24]
>> That didn't work, snort still sent out alerts for the two networks.
>> So I put HOME_NET back to ::  [10.75.0.0/16,10.76.0.0/16] And set 
>> EXTERNAL_NET to this::  [any, !10.10.0.0/24,!10.30.0.0/24], that did 
>> not work So I tried::  [any, [!10.10.0.0/24,10.30.0.0/24]], that did 
>> not work
>>
>>
>>
>> Any ideas on what I can do to fix this?
>>
>> My networks 10.75.x.x and 10.76.x.x are connected to the networks 
>> 10.10.x.x and 10.30.x.x via two Cisco PIX 515E's
>>
>>
>>
>> Thanks,
>> Seth
>>
>>
>> ---------------------------------------------------------------------
>> -
>> -------- Introducing AppDynamics Lite, a free troubleshooting tool 
>> for
>
>> Java/.NET Get 100% visibility into your production application - at 
>> no
>
>> cost.
>> Code-level diagnostics for performance bottlenecks with <2% overhead 
>> Download for free and get started troubleshooting in minutes.
>> http://p.sf.net/sfu/appdyn_d2d_ap1
>> _______________________________________________
>> Snort-users mailing list
>> Snort-users at lists.sourceforge.net
>> Go to this URL to change user options or unsubscribe:
>> https://lists.sourceforge.net/lists/listinfo/snort-users
>> Snort-users list archive:
>> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>>
>> Please visit http://blog.snort.org to stay current on all the latest 
>> Snort news!




More information about the Snort-users mailing list