Re: EXTERNAL_NET

[Phil Wood <cpw () lanl gov>]

On Sun, Jun 23, 2002 at 01:32:40AM -0400, Ashley Thomas wrote:
> Is it correct to say 
> var EXTERNAL_NET !A.B.0.0/8
>
> if i need to consider every ip except A.B.0.0 range as external ?

  var HOME_NET [A.B.0.0/16]*

  var EXTERNAL_NET !HOME_NET 

The brackets allow for some more nets like:

  var HOME_NET [A.B.0.0/16,192.168.1.0/24]

> thanks 
> ashley
>
>
> -------------------------------------------------------
> Sponsored by:
> ThinkGeek at http://www.ThinkGeek.com/
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-- 
Phil Wood, cpw () lanl gov



-------------------------------------------------------
Sponsored by:
ThinkGeek at http://www.ThinkGeek.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users