RE: Re: Noob

[Brian Stamper <BStamper () spencerhospital org>]

Am I way off here?

OK so I've originally wanted snort running inside my network to make sure
I'm not being attacked inside or scanned.  Things of that nature.  However
as I look for explanation on why I'm getting all of the false SMB Microsoft
type traffic I see that most people use the var EXTERNAL_NET !$HOME_NET.  So
what I gather is that people are not monitoring their local networks
traffic?  Am I barking up the wrong tree here with what I want or does it
just take some configuration to get around the false positives that I'm
seeing?
Thanks,
Brian


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users