[Snort-users] Semantics of ipvar HOME_NET

Research research at ...17107...
Mon Mar 2 15:15:26 EST 2015


Hello,

I am currently using snort as an IDS on a web server.

In /etc/snort/snort.conf when I have the variable “HOME_NET”, I understand that in an inline context, that would be my network block for my internal network (i.e.: 192.168.1.0/24).   In my context, though, is it correct to set HOME_NET to the IP address of my web server as the IP address is the one I am trying to monitor ?

Thanks



More information about the Snort-users mailing list