Snort mailing list archives
Re: defining $external_net
From: Erek Adams <erek () theadamsfamily net>
Date: Thu, 25 Apr 2002 06:40:36 -0700 (PDT)
On Thu, 25 Apr 2002, Metz, Tim wrote:
Hope this hasn't been addresses a million times but.....
Nope. Never been asked. ;-)
is it legit to have the following in your snort.conf: var EXTERNAL_NET !$HOME_NET
Yep.
this would keep me from replacing alot of $EXTERNAL_NET's with !$HOME_NET's in my ruleset
Works like a charm. Works very well in a situation (like colo) when you have a small block (/27, /29) out of a larger block (/24). Cheers! ----- Erek Adams Nifty-Type-Guy TheAdamsFamily.Net _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- defining $external_net Metz, Tim (Apr 25)
- Re: defining $external_net Erek Adams (Apr 25)
- <Possible follow-ups>
- RE: defining $external_net Wirth, Jeff (Apr 25)
- RE: defining $external_net Tom Sevy (Apr 25)
- RE: defining $external_net Metz, Tim (Apr 25)