Re: $HOME_NET

[Erek Adams <erek () snort org>]

On Mon, 7 Apr 2003, Keg wrote:

> 1. I get it., but on the other hand my EXTERNAL_NET is set to ANY.
> Should that  treat nessus box as external_net?

It should.

If you run Snort in sniffer mode, can you see traffic destined for the
Win32 box?

        snort -vd

> 2. Should I always use EXTERNAL_NET as !$HOME_NET?

That's up to you.  I do it to cut down on false positives.  Try it both
ways and see what works better for you.

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


-------------------------------------------------------
This SF.net email is sponsored by: ValueWeb: 
Dedicated Hosting for just $79/mo with 500 GB of bandwidth! 
No other company gives more support or power for your dedicated server
http://click.atdmt.com/AFF/go/sdnxxaff00300020aff/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users