HOME_NET question...

[Bob Hillegas <bobhillegas () pdq net>]

I see where HOST_NETWORK can be assigned in the snort.conf file or as the 
-h argument when invoking snort.

Can anyone comment on this one?

I am experimenting with logging all packets in the -b format. I intend to 
scan them later using snort -r to extract any alerts.

THE PROBLEM is that I'm on a dialip connection where the $ppp0_ADDRESS 
changes on each connection. Is there anyway to tell from the snort.log 
file what the current $HOME_NET was at the time of capture?

Thanks for all comments, especially those that are helpful. :-)

-- 
-------------------------------------------------
Bob Hillegas           
<bobhillegas () pdq net> 



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users