Snort mailing list archives
alerting on local test traffic
From: Tim.Maletic () priority-health com
Date: Tue, 18 Dec 2001 07:35:23 -0500
I can't get snort to alert on localhost traffic. I want to test snort on a system that is attached to a LAN, but I don't want any of my tests to traverse the LAN. My test traffic will trigger an alert when it's aimed at another system, but never when its source and destination are interfaces on the sensor. And this after a day's worth of playing around with HOME_NET, EXTERNAL_NET, the "-i" switch, and multiple dummy interfaces (per the faq). Will someone be kind enough to control their snickering, step forward, and point out the obvious command-line switch that will reverse this behavior? (Or in some other way help?) Thanks! Tim ******************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the Priority Health Information Services Department at (616) 942-0954. ******************************************************************** _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- alerting on local test traffic Tim . Maletic (Dec 18)
- Re: alerting on local test traffic Michael Boman (Dec 18)