Re: [Snort-users] $HOME_NET

From: Erek Adams <erek(at)snort.org>
Date: Sun Apr 06 2003 - 16:12:38 EDT

On Sun, 6 Apr 2003, Keg wrote:

> I guess I miss something.......

When you're refering to portscans, are you refering to the one of the portscan preprocessors, stream4 or some of the rules? $HOME_NET has nothing to do with any of those except for the rules.

Where are you scanning _from_? If you're scanning from inside of #1, then you won't see any alerts from the rules, but you may see them from one of the preprocessors.

---

Erek Adams

   "When things get weird, the weird turn pro." H.S. Thompson

---

This SF.net email is sponsored by: ValueWeb: Dedicated Hosting for just $79/mo with 500 GB of bandwidth! No other company gives more support or power for your dedicated server http://click.atdmt.com/AFF/go/sdnxxaff00300020aff/direct/01/

---

Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users Received on Sun Apr 6 16:18:00 2003