Re: Network Variables

[Jeremy Hoel <jthoel () gmail com>]

Yes..   since you are only negating some ip's, the rest that match will work.

On Tue, Apr 30, 2013 at 3:04 PM, Seth Dunn <seth () d2ms com> wrote:
> Ok, I think I got it corrected.
> I altered my EXTERNEL_NET variable to ::  [!10.30.0.0/24,!10.10.0.0/24]
> That seems to have stopped the false-positives, while still logging other
> traffic.
> So I am assuming there is a default "any" aspect to this variable.
>
>
>
> From: Seth Dunn [mailto:seth () d2ms com]
> Sent: Monday, April 29, 2013 10:23 AM
> To: snort-users () lists sourceforge net
> Subject: [Snort-users] Network Variables
>
>
>
> Hello,
> I am running Snort on Windows 2008 Server R2
>
> I am trying to figure out how I can bypass traffic that is being sent from
> certain networks, since it is creating false-positives
>
> Information on my setup.
> My watched networks are:: 10.75.x.x/24 and 10.76.x.x/24
> Now I also have two other networks, that are not being watched, but are part
> of my companies network and setup.
> They are:: 10.10.x.x/24 <- Office network
> 10.30.x.x/24 <- Remote VPN users
>
> Originally I tried putting in a .bpf file, but that did not work. (anyone
> know how to make it work?)
>
>
> So I tried my HOME_NET like this::
> [10.75.0.0/16,10.76.0.0/16,!10.10.0.0/24,!10.30.0.0/24]
> That didn't work, snort still sent out alerts for the two networks.
> So I put HOME_NET back to ::  [10.75.0.0/16,10.76.0.0/16]
> And set EXTERNAL_NET to this::  [any, !10.10.0.0/24,!10.30.0.0/24], that did
> not work
> So I tried::  [any, [!10.10.0.0/24,10.30.0.0/24]], that did not work
>
>
>
> Any ideas on what I can do to fix this?
>
> My networks 10.75.x.x and 10.76.x.x are connected to the networks 10.10.x.x
> and 10.30.x.x via two Cisco PIX 515E's
>
>
>
> Thanks,
> Seth
>
>
> ------------------------------------------------------------------------------
> Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET
> Get 100% visibility into your production application - at no cost.
> Code-level diagnostics for performance bottlenecks with <2% overhead
> Download for free and get started troubleshooting in minutes.
> http://p.sf.net/sfu/appdyn_d2d_ap1
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort
> news!

------------------------------------------------------------------------------
Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET
Get 100% visibility into your production application - at no cost.
Code-level diagnostics for performance bottlenecks with <2% overhead
Download for free and get started troubleshooting in minutes.
http://p.sf.net/sfu/appdyn_d2d_ap1
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!