newbie question about $HOME_NET

["Daniel Qian" <daniel.qian () supracanada com>]

I am implementing Snort on our hosting network at the point where our two 
IPS links are connected - all traffic flowing on the two VLANs for ISPs are 
SPANed to the snort sniffing port.

Some documents recommend setting $HOME_NET to my network block and a lot of 
detection rules actually have reference to this variable. The question is, 
if I want to detect bad traffic originating from a compromised host on my 
network should this variable be set to the default ANY? or is it common and 
proper way in this situation?

Thanks in advance
Daniel 


------------------------------------------------------------------------------
Come build with us! The BlackBerry® Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay 
ahead of the curve. Join us from November 9-12, 2009. Register now!
http://p.sf.net/sfu/devconf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users