[Snort-users] preprocessors rules

Dan Roberts danroberts2604 at ...11827...
Mon Feb 23 10:57:36 EST 2015


Hi all,

One of my Snort sensor (eth1) is listening to the network traffic of many
VLANs, sharing the same trunk.
And although I've defined only one VLAN (IP subnet) as my HOME_NET
in snort.conf,
I receive many preprocessor alarms related to other vlans(IP subnets)
without any relation to my HOME_NET.

My question: do the preprocessor rules apply to all the network traffic the
sensor sees, regardess the HOME_NET setting in snort.conf ? Or is there
something I missed ?

Thanks in advance for your help !

Dan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150223/6778f36a/attachment.html>


More information about the Snort-users mailing list