RE: a lot of Loopback traffic being logged.

[Matt Kettler <mkettler () evi-inc com>]

At 12:58 PM 4/22/2004, Chuck Holley wrote:
> OK, I think im on to something.  I do not use the -i option, only -c to look
> at the conf.  in the conf I have for "HOME_NET 192.168.10.0/24" and a little
> further down I have "HOME_NET any"
>
> I didn't pay much attention to that earlier because they were both not
> commented out by default.  Im still a little confused on how snort works. Is
> this the problem?

No, it's not a problem, If I remember correctly the duplicate definition 
will just cause the second one to be used.

However HOME_NET has nothing to do with what traffic snort picks up. 
HOME_NET is basically just a variable that get's substituted in various 
places in the rules and parameters to the preprocessors. It's used to give 
rules/code hints as to which end of a conversation is likely to be a part 
of your network. HOME_NET changes the alerting behaviors of snort, but 
doesn't change the low-level packet collection behaviors.

Things like -i tell snort which network interface to suck traffic in from. 
This is a very low-level thing and changes what packets enter snort in the 
first place.




-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users