RE: Defining $EXTERNAL_NET

["John Berkers" <berjo () ozemail com au>]

You can indeed.  Just put the following in the snort config file (after var
HOME_NET)

var EXTERNAL_NET !$HOME_NET

That way the $EXTERNAL_NET is anything but the $HOME_NET, assuming you have
defined $HOME_NET as your internal network.  If, like me, you have several
sensors in different parts of the network you can declare a variable that
covers all of your networks, eg CORP_NET or something, then you can use
!$CORP_NET to represent all other networks.

Hope that helps.

Regards,
John
-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net]On Behalf Of Gisli Helgason
Sent: Wednesday, 1 August 2001 19:29
To: snort-users () lists sourceforge net
Subject: [Snort-users] Defining $EXTERNAL_NET


Hi all

I am wondering if I can define $EXTERNAL_NET as any network exept my
internal network.

Any thoughts on this issue would be helpful.

Thanks, Gisli.


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users