HOME_NET and EXTERNAL_NET question

[Kresna Prawira <kprawira () esurance com>]

If I want to monitor traffic originated both from inside network and
external network, what  is the best way to do that?  The reason for this is
to monitor if any of my internal users try to hack somebody outside. 

right now I put "any" on HOME_NET and EXTERNAL_NET


thanks.

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users