Snort mailing list archives
RE: Home_net & external_net
From: "Jeremy Finke" <Jeremy.Finke () MeridianIQ com>
Date: Fri, 6 Dec 2002 08:28:47 -0600
Except that I want to view 192.168.41.0 as both an attacking and protected network. -----Original Message----- From: Erek Adams [mailto:erek () theadamsfamily net] Sent: Thu 12/5/2002 7:31 PM To: Jeremy Finke Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] Home_net & external_net On Thu, 5 Dec 2002, Jeremy Finke wrote: > I have something that is driving me crazy. > > I have alerts going off from within two different segments of my > HOME_NET. I don't understand why I am seeing these. Here are the 2 > lines from my snort.conf: > > var HOME_NET [192.168.40.0/24,192.168.41.0/24,10.14.0.0/16] > var EXTERNAL_NET [any,!192.168.40.0/24,!10.14.0.0/16] [...snip...] Make your life simple. var HOME_NET [192.168.40.0/24,192.168.41.0/24,10.14.0.0/16] var EXTERNAL_NET !$HOME_NET Cheers! ----- Erek Adams Nifty-Type-Guy TheAdamsFamily.Net N���隊X���'���u���)���Y�\�g������������b�HzG(��Jz+���ɚ�X��X��)��۬z�%��l���q����zѨ��a��.����z���m��좻����r��zm����+-��.�ǟ�����+-��b�ا~�잊��ǫ�)��۬z�%��Z��b��m���� z�+k ^��&������w�+-
Current thread:
- Home_net & external_net Jeremy Finke (Dec 05)
- RE: Home_net & external_net Don (Dec 05)
- Re: Home_net & external_net Erek Adams (Dec 05)
- <Possible follow-ups>
- RE: Home_net & external_net Jeremy Finke (Dec 06)
- RE: Home_net & external_net Erek Adams (Dec 06)
- RE: Home_net & external_net Don (Dec 06)
- RE: Home_net & external_net Erek Adams (Dec 06)
- RE: Home_net & external_net Erek Adams (Dec 06)
- RE: Home_net & external_net Jeremy Finke (Dec 06)
- RE: Home_net & external_net Erek Adams (Dec 06)
- Re: Home_net & external_net Jens Krabbenhoeft (Dec 09)
- RE: Home_net & external_net Jeremy Finke (Dec 06)
- RE: Home_net & external_net Don (Dec 06)