HOME_NET and DNS

["Taisto Qvist" <Taisto () IP-Solutions se>]

Hi folks.

I must be temporarily braindead but can someone tell me 
how the thought works behind the HOME_NET variable?
I cant seem to get snort to ignore my DNS-server traffic
generating TONS of alerts..and i feel silly since it seems
quite straight forward to config for this.

Exactly which addresses should be in HOME_NET?

Since the examples set "var DNS_SERVERS $HOME_NET"
I thought adding my entire public-IP a.b.c.d/24 adressspace in
the HOME_NET variable, would cause snort to ignore plain
dns-traffic to a.b.c.4/32 where my dns server is.

I am currently using snort 1.8.

Taisto Qvist
IP Solutions


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users