Re: EXTERNAL_NET var acting strange

[Florent <florent () arcimex com>]

That's normal :

Example : box 1.1.1.4

       !1.1.1.0         !172.16.16.0/24
         |                 |
but    False or Right or Right = Right
                 |
              !172.16.0.0/24


when snort tests !172.16.0.0/24 and !172.16.16.0/24, the IP 1.1.1.x make it right so your 1.1.1.x box gets considered 
as external_net.


Florent

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users