Snort mailing list archives
3 quick questions
From: storm <storm-shadow () comcast net>
Date: Sun, 02 Jun 2002 11:03:42 -0400
3 quick questions.
1. Below is an example of the beginning of my snort.conf. I *attempted* to correctly define the HOME_NET. I noticed one
line was set to "HOME_NET any", so I put a # sign in front of it. Was I correct in doing this?? I figured defining
HOME_NET once was enough.
2. When I go to edit the SNORT DECODER. Do I simply just uncomment the existing lines?
3. snort -A fast -c /full/route/to/snort.conf is the proper way to run in IDS mode with alerting correct? When I
tried this I got an error at the bottom of the screen that said : ERROR: Undefined variable name:
(/root/snort-2.0.0/etc/../rules/exploit.rules:21): SMTP_SERVERS Fatal Error, Quitting..
TIA
Storm
----Beginning of my snort.conf--------
# Step #1: Set the network variables:
#
# You must change the following variables to reflect
# your local network. The variable is currently
# setup for an RFC 1918 address space.
#
# You can specify it explicitly as:
#
var HOME_NET 172.16.0.1/30
#
# or use global variable $<interfacename>_ADDRESS
# which will be always initialized to IP address and
# netmask of the network interface which you run
# snort at. Under Windows, this must be specified
# as $(<interfacename>_ADDRESS), such as:
# $(\Device\Packet_{12345678-90AB-CDEF-1234567890AB}_ADDRESS)
#
# var HOME_NET $eth0_ADDRESS
#
# You can specify lists of IP addresses for HOME_NET
# by separating the IPs with commas like this:
#
# var HOME_NET [10.1.1.0/24,192.168.1.0/24]
#
# MAKE SURE YOU DON'T PLACE ANY SPACES IN YOUR LIST!
#
# or you can specify the variable to be any IP address
# like this:
# var HOME_NET any (I put a # sign in front of this one)
# Set up the external network addresses as well.
# A good start may be "any"
var EXTERNAL_NET any
---End of snort.conf----
Current thread:
- 3 quick questions storm (Jun 02)
- <Possible follow-ups>
- 3 quick questions storm (Jun 03)
