Snort mailing list archives
Re: More on home_net and external_net
From: Erek Adams <erek () theadamsfamily net>
Date: Tue, 14 Aug 2001 05:31:05 -0700 (PDT)
[Disclaimer: The following is written before _any_ coffee for the morning.] On Tue, 14 Aug 2001, Gisli Helgason wrote:
Hi all
Morning!
I would like to configure my rules to log and alert in the following way. home > home external > home NOT home > external Is there any way to configure my snort.conf to do that.
Actually... I think it might be easier to configure it as: var HOME_NET 10.10.10.0/29 var EXTERNAL_NET !$HOME_NET Or if it's a list: var HOME_NET [10.10.10.0/29,10.10.9.0/24] var EXTERNAL_NET !$HOME_NET
Thanks, for all your help in the past.
:) If you'll excuse me, I hear the coffee pot calling my name... ----- Erek Adams Nifty-Type-Guy TheAdamsFamily.Net _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- More on home_net and external_net Gisli Helgason (Aug 14)
- Re: More on home_net and external_net Erek Adams (Aug 14)
- <Possible follow-ups>
- RE: More on home_net and external_net Gisli Helgason (Aug 14)
- RE: More on home_net and external_net Erek Adams (Aug 14)
- RE: More on home_net and external_net Kris Quinby (Aug 14)