Snort mailing list archives
3 quick questions
From: storm <storm-shadow () comcast net>
Date: Sun, 02 Jun 2002 11:03:42 -0400
3 quick questions. 1. Below is an example of the beginning of my snort.conf. I *attempted* to correctly define the HOME_NET. I noticed one line was set to "HOME_NET any", so I put a # sign in front of it. Was I correct in doing this?? I figured defining HOME_NET once was enough. 2. When I go to edit the SNORT DECODER. Do I simply just uncomment the existing lines? 3. snort -A fast -c /full/route/to/snort.conf is the proper way to run in IDS mode with alerting correct? When I tried this I got an error at the bottom of the screen that said : ERROR: Undefined variable name: (/root/snort-2.0.0/etc/../rules/exploit.rules:21): SMTP_SERVERS Fatal Error, Quitting.. TIA Storm ----Beginning of my snort.conf-------- # Step #1: Set the network variables: # # You must change the following variables to reflect # your local network. The variable is currently # setup for an RFC 1918 address space. # # You can specify it explicitly as: # var HOME_NET 172.16.0.1/30 # # or use global variable $<interfacename>_ADDRESS # which will be always initialized to IP address and # netmask of the network interface which you run # snort at. Under Windows, this must be specified # as $(<interfacename>_ADDRESS), such as: # $(\Device\Packet_{12345678-90AB-CDEF-1234567890AB}_ADDRESS) # # var HOME_NET $eth0_ADDRESS # # You can specify lists of IP addresses for HOME_NET # by separating the IPs with commas like this: # # var HOME_NET [10.1.1.0/24,192.168.1.0/24] # # MAKE SURE YOU DON'T PLACE ANY SPACES IN YOUR LIST! # # or you can specify the variable to be any IP address # like this: # var HOME_NET any (I put a # sign in front of this one) # Set up the external network addresses as well. # A good start may be "any" var EXTERNAL_NET any ---End of snort.conf----
Current thread:
- 3 quick questions storm (Jun 02)
- <Possible follow-ups>
- 3 quick questions storm (Jun 03)