Snort mailing list archives

alerting on local test traffic


From: Tim.Maletic () priority-health com
Date: Tue, 18 Dec 2001 07:35:23 -0500

I can't get snort to alert on localhost traffic.  I want to test snort on a
system that is attached to a LAN, but I don't want any of my tests to
traverse the LAN.  My test traffic will trigger an alert when it's aimed at
another system, but never when its source and destination are interfaces on
the sensor.  And this after a day's worth of playing around with HOME_NET,
EXTERNAL_NET, the "-i" switch, and multiple dummy interfaces (per the faq).

Will someone be kind enough to control their snickering, step forward, and
point out the obvious command-line switch that will reverse this behavior?
(Or in some other way help?)

Thanks!
Tim


********************************************************************
This email and any files transmitted with it are confidential
and intended solely for the use of the individual or entity
to whom they are addressed.  If you have received this 
email in error please notify the Priority Health Information
Services Department at (616) 942-0954.
********************************************************************


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: