Re: [Snort-users] $HOME_NET

From: Erek Adams <erek(at)snort.org>
Date: Tue Apr 08 2003 - 10:20:50 EDT

On Mon, 7 Apr 2003, Keg wrote:

> 1. I get it., but on the other hand my EXTERNAL_NET is set to ANY.

It should.

If you run Snort in sniffer mode, can you see traffic destined for the Win32 box?

        snort -vd

> 2. Should I always use EXTERNAL_NET as !$HOME_NET?

That's up to you. I do it to cut down on false positives. Try it both ways and see what works better for you.

---

Erek Adams

   "When things get weird, the weird turn pro." H.S. Thompson

---

This SF.net email is sponsored by: ValueWeb: Dedicated Hosting for just $79/mo with 500 GB of bandwidth! No other company gives more support or power for your dedicated server http://click.atdmt.com/AFF/go/sdnxxaff00300020aff/direct/01/

---

Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users Received on Tue Apr 8 10:27:07 2003