Re: Noob question on snort.conf

[John Sage <jsage () finchhaven com>]

Just a quick question:

On Sat, Jun 01, 2002 at 10:58:33PM -0400, storm wrote:
> Hi everyone. Need a little help with snort.conf editing.
> i ucommented the line that says:
>
> #You can specify it explicity as:
> #var HOME_NET 10.1.1.0/24
>
> #or use global variable etc etc
>
> and I commented it to:
>
> #var HOME_NET 172.16.0.1/30


I'm always curious about unusual netmasks; 172.16.0.1/30 translates into:


Address:   172.16.0.1            10101100.00010000.00000000.000000 01

Netmask:   255.255.255.252 = 30  11111111.11111111.11111111.111111 00

Wildcard:  0.0.0.3               00000000.00000000.00000000.000000 11

=>
Network:   172.16.0.0/30         10101100.00010000.00000000.000000 00 (Class B)

Broadcast: 172.16.0.3            10101100.00010000.00000000.000000 11

HostMin:   172.16.0.1            10101100.00010000.00000000.000000 01

HostMax:   172.16.0.2            10101100.00010000.00000000.000000 10

Hosts/Net: 2                     (Private Internet)


This looks to be a network with two hosts, *.1 and *.2

Is this what you actually intend to do?


- John
-- 
"You are in a twisty maze of weblogs, all alike."

See our all-new look! http://www.finchhaven.com/


-------------------------------------------------------
This SF.net email is sponsored by:  Etnus, makers of TotalView, The best
thread debugger on the planet. Designed with thread debugging features
you've never dreamed of, try TotalView 6 free at www.etnus.com.
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users