Re: newbie configuration issues

[Paul Greene <pauljgreene () comcast net>]

At 10:14 PM 7/23/2002 -0700, John Sage wrote:

> How do you have $HOME_NET and $EXTERNAL_NET set?

Maybe it would be good to work out this $HOME_NET and $EXTERNAL_NET aspect 
first before getting into more esoteric stuff.

In snort.conf, I've tried changing the line:

"var HOME_NET any"

to "var HOME_NET [192.168.0.0/24,64.48.xxx.xxx]"

(note the second is a single IP address; I don't want the rest of my ISP to 
be considered part of my home network)

How do you set the EXTERNAL_NET to be <anything other than HOME_NET>?

> /* somehow I'm having a hard time picturing this: the modem and
> the "IDS bridge" are just acting as though they're wire: packets just
> pass through with their IP addresses unexamined? */

Yes and no. The packets pass through like a wire, but snort (is supposed 
to) examines every single packet going by.

Paul




-------------------------------------------------------
This sf.net email is sponsored by: Jabber - The world's fastest growing 
real-time communications platform! Don't just IM. Build it in! 
http://www.jabber.com/osdn/xim
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users