Re: Snort + Demarc

[Chris Green <cmg () uab edu>]

Mika Tuunanen <tuumi () sci fi> writes:

> Hi all..
>
> I installed snort + demarc and put it running..
> Problem now is that it takes _all data_ and puts it in
> database.. (including all machines in our C class)
> I want demarc to log only my own machines data..

You probably haven't set your HOME_NET to just your IP

> Could anyone throw me commented snort.conf or point to some 'n00b
> understandable' site?  snort's own document page is gibberish to me.

The default snort.conf is pretty well commented.  The first chapter of
the snort user's manaul gives a pretty good walk through on using
snort for the first time to understand it a bit more.

Please ask in detail about what you don't understand.  We can try and
meet you halfway but not knowing where you got lost along the way
leaves you unhappy that you can't figure out snort and leaves us
unhappy that we have no clue why you can't figure out snort.

I am interested in improving the docs but need help on where to
concentrate efforts
-- 
Chris Green <cmg () uab edu>
To err is human, to moo bovine.

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users