Re: Does setting HOME_NET have any effect in Stealth mode?

["Alex Butcher, ISC/ISYS" <Alex.Butcher () bristol ac uk>]

--On 02 November 2004 13:05 +0000 Rob Ward <rob.ward () liverpool ac uk> wrote:

> When I set "HOME_NET" to anything other than 'any' I no longer see any
> DOS or DDOS alerts but P2P alerts are still output.

Depending on how the P2P rules in question are written, that will still be 
the case. If you don't want to know which of your hosts in $HOME_NET are 
using P2P services, why do you have the rules enabled?

> I've tried following the configuration examples in the FAQ's etc and 
can't
> get it to work. I'm wondering if HOME_NET has any relevance when running
> snort in 'stealth' or am I wide of the mark?

You're wide of the mark. Running the sniffing interface with no IP address 
has no interaction with HOME_NET, whether it's left at 'any' or not. :-)

> Also - can snort cope with variable length subnet masks?

Looks like it, from reading the source for ParseIP() in parser/IpAddrSet.c. 
I'd be surprised if it doesn't handle VLSM flawlessly, just as I was 
surprised when Solaris still didn't back around '98/99 or so.

> Rob Ward

Best Regards,
Alex.
--
Alex Butcher: Security & Integrity, Personal Computer Systems Group
Information Systems and Computing             GPG Key ID: F9B27DC9
GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9




-------------------------------------------------------
This SF.Net email is sponsored by:
Sybase ASE Linux Express Edition - download now for FREE
LinuxWorld Reader's Choice Award Winner for best database on Linux.
http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users