[Snort-users] configure snort when using NAT

mehdi maleki mehdimlk2003 at ...131...
Thu Aug 20 08:03:48 EDT 2015

i try to use cdx dataset(http://www.usma.edu/crc/SitePages/DataSets.aspx)
they mention that used NAT(network address translation) in their network.
their network topology is here:(http://www.usma.edu/crc/SiteAssets/SitePages/DataSets/CDX_2009_Network_USMA.pdf)i mix how configure HOME_NET variable in snort.conf?  should i use internal address or external address? they deliver a snort alert output file(https://drive.google.com/open?id=0B0u9Tg7udaAXd3dZVGRVWWJ1ZW8&authuser=0), but addresses in this file is different from my SO generated alert file. please help me how configure HOME & EXternal ip address in snort.conf for using this dataset Sincerely yours Mahdi Maleki
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150820/fd288283/attachment.html>

More information about the Snort-users mailing list