Re: [Snort-sigs] ftp rules question - why only external to internal?

From: Terence Runge <terencerunge(at)sbcglobal.net>
Date: Fri Apr 25 2003 - 13:08:36 EDT

This depends entirely on what you deem important to monitor for. What do you define an $EXTERNAL_NET? In some instances, I have defined specific vlans as the $EXTERNAL_NET or $HOME_NET, especially when running snort for site to site internal monitoring sniffing the uplink. Create virtual interfaces and try running multiple instances of snort with well defined snort.conf and *.rules.

-tcr

Jerry.L.Rose@saj02.usace.army.mil wrote:

> I see there are several "bad" sections in the ftp rules ("bad files"

---

This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven.
http://thinkgeek.com/sf

---

Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs Received on Fri Apr 25 13:44:56 2003