[Snort-users] Best practices for setting HOME_NET
jesler at ...1935...
Fri Jan 11 10:20:52 EST 2013
On Jan 10, 2013, at 11:02 PM, Craig Merchant <cmerchant at ...16022...> wrote:
> What are the best practices for setting the HOME_NET variable in an environment where multiple sensors exist at different sites or datacenters? Is it considered best to set it to a network range that encompasses all of the sites, or generally is it considered best to treat intra-site traffic as external?
HOME_NET is to be set to what you are trying to protect from whatever EXTERNAL_NET is.
Senior Research Engineer, VRT
OpenSource Community Manager
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users