Snort mailing list archives
Re: Config Question
From: Frank Knobbe <frank () knobbe us>
Date: Tue, 04 Apr 2006 17:16:38 -0500
On Tue, 2006-04-04 at 07:14 -0400, James Jalbert wrote:
Here is the Home_Net protion of my config. I tried to get the error message I recived when I tried this before, but damn if I typed the information in the config again, and this time snort started with no errors. I have not yet chacked BASE to besure that I am getting things, But could you verify that this is the proper context for me.
# You can specify lists of IP addresses for HOME_NET # by separating the IPs with commas like this: # # var HOME_NET [10.1.1.0/24,192.168.1.0/24] # # MAKE SURE YOU DON'T PLACE ANY SPACES IN YOUR LIST!
var HOME_NET xx.xx.94.0/23,xx.xx.72.0/23,xx.xx.74.128/25,xx.xx.74.0/25,xx.xx.75.0/25,xx.xx.75.128/26,xx.xx75.192/26
Why did you omit the brackets? They are in the example for a reason. Have you checked the Snort manual? Your answer is right here: http://www.snort.org/docs/snort_htmanuals/htmanual_2.4/rc1/node16.html#SECTION00423000000000000000 -Frank -- It is said that the Internet is a public utility. As such, it is best compared to a sewer. A big, fat pipe with a bunch of crap sloshing against your ports.
Attachment:
signature.asc
Description: This is a digitally signed message part
Current thread:
- Config Question James Jalbert (Apr 03)
- Re: Config Question Matt Kettler (Apr 03)
- Re: Config Question Lorine Ruotolo (Apr 03)
- Re: Config Question Matt Kettler (Apr 03)
- Re: Config Question James Jalbert (Apr 04)
- Re: Config Question Frank Knobbe (Apr 04)
- Re: Config Question Lorine Ruotolo (Apr 03)
- RE: Config Question Patrick S. Harper (Apr 03)
- <Possible follow-ups>
- Re: Config Question Carl Brown (Apr 04)
- Re: Config Question Matt Kettler (Apr 03)