Snort mailing list archives
RE: More on home_net and external_net
From: Gisli Helgason <Gisli () gltrade co uk>
Date: Tue, 14 Aug 2001 14:48:52 +0100
Sorry bur I was not wery clear on what I wanted. I want to see attacks originating on external and home with a destination of home. I do not want to see attacks originating in home and with a destination of external. I already have the configuration you gave me but I am missing all attacks from home to home. Thanks again, Gisli. -----Original Message----- From: Erek Adams [mailto:erek () theadamsfamily net] Sent: 14 August 2001 13:31 To: Gisli Helgason Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] More on home_net and external_net [Disclaimer: The following is written before _any_ coffee for the morning.] On Tue, 14 Aug 2001, Gisli Helgason wrote:
Hi all
Morning!
I would like to configure my rules to log and alert in the following way. home > home external > home NOT home > external Is there any way to configure my snort.conf to do that.
Actually... I think it might be easier to configure it as: var HOME_NET 10.10.10.0/29 var EXTERNAL_NET !$HOME_NET Or if it's a list: var HOME_NET [10.10.10.0/29,10.10.9.0/24] var EXTERNAL_NET !$HOME_NET
Thanks, for all your help in the past.
:) If you'll excuse me, I hear the coffee pot calling my name... ----- Erek Adams Nifty-Type-Guy TheAdamsFamily.Net _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- More on home_net and external_net Gisli Helgason (Aug 14)
- Re: More on home_net and external_net Erek Adams (Aug 14)
- <Possible follow-ups>
- RE: More on home_net and external_net Gisli Helgason (Aug 14)
- RE: More on home_net and external_net Erek Adams (Aug 14)
- RE: More on home_net and external_net Kris Quinby (Aug 14)