[Snort-users] Semantics of ipvar HOME_NET
research at ...17107...
Mon Mar 2 15:15:26 EST 2015
I am currently using snort as an IDS on a web server.
In /etc/snort/snort.conf when I have the variable “HOME_NET”, I understand that in an inline context, that would be my network block for my internal network (i.e.: 192.168.1.0/24). In my context, though, is it correct to set HOME_NET to the IP address of my web server as the IP address is the one I am trying to monitor ?
More information about the Snort-users