Re: Snort IGNORES var HOME_NET

[Leonardo Alcantara Moreira <leonardo () montreal com br>]

On Fri, 3 May 2002 09:18:53 GMT
<counterping () uk2 net> wrote:

> Hiya,
>
> I am fairly new to the world of Snort and hopefully someone maybe able to help 
> me out: (1.83 ver)
>
> I have set up several networks within the home_net variable under snort.conf
> var HOME_NET 
> [64.6.189.0/24,172.16.10.0/24,10.10.60.10/24,10.10.30.0/16,192.168.10.0/24,192.1
> 68.20.0/24]
>
> However, SNORT seems to IGNORE these networks as my Home Networks and send 
> alarms for HOME to HOME intrusions.
>
> For example,
> I am still seeing lots of alarms from my 172.16.10.0 home network to my 
> 10.10.30.0 home network,
> If a particular rule specifies EXTERNAL_NET -> HOME_NET surely I should NOT get 
> alerted when the packet is sent from my home network to another home network ?
> i.e 172.16.10.35 -----> 10.10.30.10
>
> Any help would be greatly appreciated

        What is your EXTERNAL_NET definition ??? Does it include this networks ???
Probably u left the default "any". And that means really ANY, including your home
nets. You should try !$HOME_NET as a safe bet.

      Best regards,


        Leonardo Alcantara

_______________________________________________________________

Have big pipes? SourceForge.net is looking for download mirrors. We supply
the hardware. You get the recognition. Email Us: bandwidth () sourceforge net
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users