Snort mailing list archives

RE: home_net and ext_net question

From: "Everist, Benjamin S. (NASWI)" <EveristB () naswi navy mil>
Date: Thu, 24 Apr 2003 14:38:45 -0700

<snip>

Having HOME_NET encapsulate two or more networks can do funny things to the
Snort rules when one simply negates EXTERNAL_NET (i.e., var EXTERNAL_NET
!$HOME_NET, or some variant).


What kinds of funny things?

Current thread:

home_net and ext_net question Mike Zupan (Apr 23)
- <Possible follow-ups>
- Re: home_net and ext_net question Neil Dickey (Apr 23)
- RE: home_net and ext_net question L. Christopher Luther (Apr 23)
- RE: home_net and ext_net question Everist, Benjamin S. (NASWI) (Apr 24)
  - RE: home_net and ext_net question Matt Kettler (Apr 24)
- RE: home_net and ext_net question L. Christopher Luther (Apr 25)
- RE: home_net and ext_net question Matt Kettler (Apr 25)
- RE: home_net and ext_net question L. Christopher Luther (Apr 25)
- RE: home_net and ext_net question Neil Dickey (Apr 25)
  - RE: home_net and ext_net question Matt Kettler (Apr 25)