RE: snort.conf & commandline.

["Don" <Don () WeberOnTheWeb com>]

there seems to be some confusion here, i am anyway,
the following variables, will set External_net == equal to Home_net
var EXTERNAL_NET = $HOME_NET doesn't work (I tried it yesterday)
var EXTERNAL_NET $HOME_NET is ok (I tried it now)

you dont want that!!
the following will set External_Net to anything BUT home_net

var EXTERNAL_NET !$HOME_NET

this is what you want, unless you are only wanting to detect your home_net
traffic, and of course you need to make sure home_net is not set to ""any""
so your home_net variable should be set to your IP like so

var Home_Net 192.168.0.0/24
or whatever your ip address/range is
var Home_Net [192.168.0.25/32,192.168.0.30/32]
etc...



> > -----Original Message-----
> > From: snort-users-admin () lists sourceforge net
> > [mailto:snort-users-admin () lists sourceforge net]On Behalf Of Sander
> > Smeenk
> > Sent: Wednesday, July 10, 2002 12:44 AM
> > To: Francesca Milanini
> > Cc: Rich Adamson; snort-users () lists sourceforge net
> > Subject: Re: [Snort-users] snort.conf & commandline.
> >
> >
> > Quoting Francesca Milanini (francesca.milanini () fastwebnet it):
> > > var EXTERNAL_NET = $HOME_NET doesn't work (I tried it yesterday)
> > > var EXTERNAL_NET $HOME_NET is ok (I tried it now)
> >
> > So 'var EXTERNAL_NET !$HOME_NET' is ok too ? =)
> >
> > Regards,
> > Sander.
> >
> > --
> > | Love comes back to you <-=|=-> you to back comes Love
> > | 1024D/08CEC94D - 34B3 3314 B146 E13C 70C8  9BDB D463 7E41 08CE C94D
> >
> >
> > -------------------------------------------------------
> > This sf.net email is sponsored by:ThinkGeek
> > Two, two, TWO treats in one.
> > http://thinkgeek.com/sf
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Two, two, TWO treats in one.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users