Re: Best practices for setting HOME_NET

[Joel Esler <jesler () sourcefire com>]

On Jan 10, 2013, at 11:02 PM, Craig Merchant <cmerchant () responsys com> wrote:

> What are the best practices for setting the HOME_NET variable in an environment where multiple sensors exist at 
> different sites or datacenters?  Is it considered best to set it to a network range that encompasses all of the 
> sites, or generally is it considered best to treat intra-site traffic as external?

Shortly:

HOME_NET is to be set to what you are trying to protect from whatever EXTERNAL_NET is.

--
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire

------------------------------------------------------------------------------
Master HTML5, CSS3, ASP.NET, MVC, AJAX, Knockout.js, Web API and
much more. Get web development skills now with LearnDevNow -
350+ hours of step-by-step video tutorials by Microsoft MVPs and experts.
SALE $99.99 this month only -- learn more at:
http://p.sf.net/sfu/learnmore_122812

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!