Snort mailing list archives
RE: Multiple Subnets in sr net
From: "Jeff Dell" <jdell () activeworx com>
Date: Fri, 25 Jun 2004 18:02:24 -0400
Snort uses Berkley Packet Filters.. To do this try the following: $SNORT_PATH/snort -c $CONFIG -i $IFACE -g $SNORT_GID $OPTIONS src net 10.1.1.0/24 or src net 10.2.1.0/24 Cheers, Jeff -----Original Message----- From: Devanathan, Balaji (Corporate, consultant) [mailto:balaji.devanathan () ge com] Sent: Friday, June 25, 2004 4:35 PM To: Jeff Dell; Snort-Users (E-mail) Subject: RE: [Snort-users] Multiple Subnets in sr net I am not specifying it in HOME_NET. I want snort to monitor the whole network and sent alerts only for specific subnets. Hence i add the option src net in the snort script as $SNORT_PATH/snort -c $CONFIG -i $IFACE -g $SNORT_GID $OPTIONS src net 10.1.1.0/24 My question is how to add the second subnet 10.1.2.0/24 in this. Cheers Devanathan.B -----Original Message----- From: Jeff Dell [mailto:jdell () activeworx com] Sent: Saturday, June 26, 2004 1:59 AM To: Devanathan, Balaji (Corporate, consultant); 'Snort-Users (E-mail)' Subject: RE: [Snort-users] Multiple Subnets in sr net Sure, here is an example on how you can do this: var HOME_NET [10.1.1.0/24,10.2.1.0/24] Note: There is not a space between subnets. Jeff -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Devanathan, Balaji (Corporate, consultant) Sent: Friday, June 25, 2004 4:16 PM To: Snort-Users (E-mail) Subject: [Snort-users] Multiple Subnets in sr net Hi, Can multiple ip subnets be given in the src net option in snort. I have snort monitoring the whole 10.0.0.0/8 network and i want snort alerts from 10.1.1.0/24 and 10.2..1.0/24 . Cheers Devanathan.B ------------------------------------------------------- This SF.Net email sponsored by Black Hat Briefings & Training. Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=ort-users ------------------------------------------------------- This SF.Net email sponsored by Black Hat Briefings & Training. Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Multiple Subnets in sr net Devanathan, Balaji (Corporate, consultant) (Jun 25)
- RE: Multiple Subnets in sr net Jeff Dell (Jun 25)
- Re: Multiple Subnets in sr net Frank Knobbe (Jun 25)
- <Possible follow-ups>
- RE: Multiple Subnets in sr net Murray, Todd (Jun 25)
- RE: Multiple Subnets in sr net Devanathan, Balaji (Corporate, consultant) (Jun 25)
- RE: Multiple Subnets in sr net Jeff Dell (Jun 25)
- RE: Multiple Subnets in sr net Frank Knobbe (Jun 25)
- RE: Multiple Subnets in sr net Jeff Dell (Jun 25)