Snort mailing list archives
Re: Best practices for setting HOME_NET
From: Jeremy Hoel <jthoel () gmail com>
Date: Fri, 11 Jan 2013 18:42:19 +0000
As an example.. we have a large /16 spread across a number of sites.. and so i made home_net the /16 vs the smaller /24 that each sensor sits at, because i consider the whole /16 to be home.. and I wanted one simple config vs a lot of little ones. it's worked well for us so far.. On Fri, Jan 11, 2013 at 4:02 AM, Craig Merchant <cmerchant () responsys com> wrote:
What are the best practices for setting the HOME_NET variable in an environment where multiple sensors exist at different sites or datacenters? Is it considered best to set it to a network range that encompasses all of the sites, or generally is it considered best to treat intra-site traffic as external? Thx. Craig ------------------------------------------------------------------------------ Master HTML5, CSS3, ASP.NET, MVC, AJAX, Knockout.js, Web API and much more. Get web development skills now with LearnDevNow - 350+ hours of step-by-step video tutorials by Microsoft MVPs and experts. SALE $99.99 this month only -- learn more at: http://p.sf.net/sfu/learnmore_122812 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
------------------------------------------------------------------------------ Master HTML5, CSS3, ASP.NET, MVC, AJAX, Knockout.js, Web API and much more. Get web development skills now with LearnDevNow - 350+ hours of step-by-step video tutorials by Microsoft MVPs and experts. SALE $99.99 this month only -- learn more at: http://p.sf.net/sfu/learnmore_122812 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Best practices for setting HOME_NET Craig Merchant (Jan 10)
- Re: Best practices for setting HOME_NET Joel Esler (Jan 11)
- Re: Best practices for setting HOME_NET Kevin Ross (Jan 11)
- Re: Best practices for setting HOME_NET Mike Miller (Jan 11)
- Re: Best practices for setting HOME_NET Joel Esler (Jan 11)
- Re: Best practices for setting HOME_NET Mike Miller (Jan 11)
- Re: Best practices for setting HOME_NET Joel Esler (Jan 11)
- Re: Best practices for setting HOME_NET waldo kitty (Jan 11)
- Re: Best practices for setting HOME_NET waldo kitty (Jan 11)
- Re: Best practices for setting HOME_NET Mike Miller (Jan 11)