Snort mailing list archives

Re: Only traffic going in???

From: Erek Adams <erek () snort org>
Date: Mon, 10 Feb 2003 06:57:04 -0500 (EST)

On Sun, 9 Feb 2003, Sh J wrote:


Hello u all,

Hope my question wont sound to stupied to u all - I get alot of alerts
from inside my net to the outside (like web iis,web cgi, web misc) my
question is how do i log alert only from the outside that what intrest
me the most.

(win2000,snort 1.9) THANKS A LOT!!!!


Change your HOME_NET and EXTERNAL_NET definitions.

  var HOME_NET 10.10.10.0/27
  var EXTERNAL_NET !$HOME_NET


Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Current thread:

Only traffic going in??? Sh J (Feb 09)
- Re: Only traffic going in??? Erek Adams (Feb 10)