[Snort-users] Best practices for setting HOME_NET

Joel Esler jesler at ...1935...
Fri Jan 11 10:20:52 EST 2013


On Jan 10, 2013, at 11:02 PM, Craig Merchant <cmerchant at ...16022...> wrote:

> What are the best practices for setting the HOME_NET variable in an environment where multiple sensors exist at different sites or datacenters?  Is it considered best to set it to a network range that encompasses all of the sites, or generally is it considered best to treat intra-site traffic as external?

Shortly:

HOME_NET is to be set to what you are trying to protect from whatever EXTERNAL_NET is.

--
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130111/8e6bd818/attachment.html>


More information about the Snort-users mailing list