RE: More on home_net and external_net

[Gisli Helgason <Gisli () gltrade co uk>]

Sorry bur I was not wery clear on what I wanted.

I want to see attacks originating on external and home with a destination of
home.  

I do not want to see attacks originating in home and with a destination of
external.

I already have the configuration you gave me but I am missing all attacks
from home to home.

Thanks again, Gisli.

-----Original Message-----
From: Erek Adams [mailto:erek () theadamsfamily net]
Sent: 14 August 2001 13:31
To: Gisli Helgason
Cc: snort-users () lists sourceforge net
Subject: Re: [Snort-users] More on home_net and external_net



[Disclaimer:  The following is written before _any_ coffee for the morning.]

On Tue, 14 Aug 2001, Gisli Helgason wrote:

> Hi all

Morning!

> I would like to configure my rules to log and alert in the following way.
>
> home > home
> external > home
> NOT home > external
>
> Is there any way to configure my snort.conf to do that.

Actually...  I think it might be easier to configure it as:

var HOME_NET 10.10.10.0/29

var EXTERNAL_NET !$HOME_NET

Or if it's a list:

var HOME_NET [10.10.10.0/29,10.10.9.0/24]

var EXTERNAL_NET !$HOME_NET


> Thanks, for all your help in the past.

:)

If you'll excuse me, I hear the coffee pot calling my name...

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users