Re: snort.conf

[Frank Knobbe <frank () knobbe us>]

On Thu, 2005-01-13 at 16:38 -0500, spiv007 wrote:
> Right that what im wondering will "var EXTERNAL_NET !$HOME_NET" show
> me an internet address attaching another internal address.
>
> Im using bleeding rules to detect virus and spyware.  I was thinking
> "var EXTERNAL_NET any" will be my best option for this case.

If you want to catch HOME_NET -> HOME_NET, then yes.

Or you can mix them. I have snort.conf's that first set EXTERNAL_NET to
HOME_NET, then include various rule sets, and then set EXTERNAL_NET to
any, and include some selected rule sets.

If all depends on what YOU want to catch.

Cheers,
Frank


PS: I wonder what would happen if I set "var HOME_NET !$EXTERNAL_NET" ;)

Attachment: signature.asc
Description: This is a digitally signed message part