Snort mailing list archives
Re: Home_net & external_net
From: Erek Adams <erek () theadamsfamily net>
Date: Thu, 5 Dec 2002 17:31:38 -0800 (PST)
On Thu, 5 Dec 2002, Jeremy Finke wrote:
I have something that is driving me crazy. I have alerts going off from within two different segments of my HOME_NET. I don't understand why I am seeing these. Here are the 2 lines from my snort.conf: var HOME_NET [192.168.40.0/24,192.168.41.0/24,10.14.0.0/16] var EXTERNAL_NET [any,!192.168.40.0/24,!10.14.0.0/16]
[...snip...] Make your life simple. var HOME_NET [192.168.40.0/24,192.168.41.0/24,10.14.0.0/16] var EXTERNAL_NET !$HOME_NET Cheers! ----- Erek Adams Nifty-Type-Guy TheAdamsFamily.Net ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Home_net & external_net Jeremy Finke (Dec 05)
- RE: Home_net & external_net Don (Dec 05)
- Re: Home_net & external_net Erek Adams (Dec 05)
- <Possible follow-ups>
- RE: Home_net & external_net Jeremy Finke (Dec 06)
- RE: Home_net & external_net Erek Adams (Dec 06)
- RE: Home_net & external_net Don (Dec 06)
- RE: Home_net & external_net Erek Adams (Dec 06)
- RE: Home_net & external_net Erek Adams (Dec 06)
- RE: Home_net & external_net Jeremy Finke (Dec 06)
- RE: Home_net & external_net Erek Adams (Dec 06)
- Re: Home_net & external_net Jens Krabbenhoeft (Dec 09)
- RE: Home_net & external_net Jeremy Finke (Dec 06)
- RE: Home_net & external_net Don (Dec 06)