Snort mailing list archives
RE: Multiple Subnets in sr net
From: "Murray, Todd" <Todd.Murray () adidasus com>
Date: Fri, 25 Jun 2004 13:33:36 -0700
3.4 My network spans multiple subnets. How do I define HOME_NET? Snort 1.7 supports IP lists. You can assign a number of addresses to a single variable. For example: var HOME_NET [10.1.1.0/24,192.168.1.0/24] Note: Not all preprocessors support IP lists at this time. Unless otherwise stated, assume that any preprocessor using an IP list variable will use the first value as the HOME_NET. The portscan preprocessor is an example. To catch all detectable portscans, pass 0.0.0.0/0 in as the first parameter. preprocessor portscan: 0.0.0.0/0 5 3 portscan.log Use the portscan-ignorehosts preprocessor to fine tune and ignore traffic from noisy, trusted machines. Read section 3.4 of the FAQ. http://www.snort.org/docs/FAQ.txt -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Devanathan, Balaji (Corporate, consultant) Sent: Friday, June 25, 2004 1:16 PM To: Snort-Users (E-mail) Subject: [Snort-users] Multiple Subnets in sr net Hi, Can multiple ip subnets be given in the src net option in snort. I have snort monitoring the whole 10.0.0.0/8 network and i want snort alerts from 10.1.1.0/24 and 10.2..1.0/24 . Cheers Devanathan.B ------------------------------------------------------- This SF.Net email sponsored by Black Hat Briefings & Training. Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- This SF.Net email sponsored by Black Hat Briefings & Training. Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Multiple Subnets in sr net Devanathan, Balaji (Corporate, consultant) (Jun 25)
- RE: Multiple Subnets in sr net Jeff Dell (Jun 25)
- Re: Multiple Subnets in sr net Frank Knobbe (Jun 25)
- <Possible follow-ups>
- RE: Multiple Subnets in sr net Murray, Todd (Jun 25)
- RE: Multiple Subnets in sr net Devanathan, Balaji (Corporate, consultant) (Jun 25)
- RE: Multiple Subnets in sr net Jeff Dell (Jun 25)
- RE: Multiple Subnets in sr net Frank Knobbe (Jun 25)
- RE: Multiple Subnets in sr net Jeff Dell (Jun 25)