RE: Home_net & external_net

["Jeremy Finke" <Jeremy.Finke () MeridianIQ com>]

Except that I want to view 192.168.41.0 as both an attacking and protected network.

        -----Original Message----- 
        From: Erek Adams [mailto:erek () theadamsfamily net] 
        Sent: Thu 12/5/2002 7:31 PM 
        To: Jeremy Finke 
        Cc: snort-users () lists sourceforge net 
        Subject: Re: [Snort-users] Home_net & external_net
        
        

        On Thu, 5 Dec 2002, Jeremy Finke wrote:
        
        > I have something that is driving me crazy.
        >
        > I have alerts going off from within two different segments of my
        > HOME_NET.  I don't understand why I am seeing these.  Here are the 2
        > lines from my snort.conf:
        >
        > var HOME_NET [192.168.40.0/24,192.168.41.0/24,10.14.0.0/16]
        > var EXTERNAL_NET [any,!192.168.40.0/24,!10.14.0.0/16]
        
        [...snip...]
        
        Make your life simple.
        
                var HOME_NET [192.168.40.0/24,192.168.41.0/24,10.14.0.0/16]
                var EXTERNAL_NET !$HOME_NET
        
        Cheers!
        
        
        -----
        Erek Adams
        Nifty-Type-Guy
        TheAdamsFamily.Net
        

N���޵隊X���'���u���)���Y�\�g������������b�HzG(��Jz+���ɚ�X��X��)��۬z�%��l���q����zѨ��a��.����z���m��좻����r��zm����+-��.�ǟ�����+-��b�ا~�잊��ǫ�)��۬z�%��Z��b��m����
 z�+k     ^��&������w�+-