Re: filtering bridge

[Matt Kettler <mkettler () evi-inc com>]

At 05:14 AM 10/21/2004, jvarlet () aressi fr wrote:
> I would like to know if it is possible to use snort on a bridge.
> All uses of snort I made was built on ip adresses.
>
> But a bridge has no ip adress...

Snort doesn't care about wether or not the ethernet interface it uses has 
an IP address or not.. See the "stealth" interface notes in the FAQ.

Snort just picks up raw ethernet frames with pcap. If tcpdump can grab 
packets off it, so can snort.

However, you will need to set up HOME_NET and EXTERNAL_NET. In the case of 
a bridge, I'd probably just set these both to "any".

Generally speaking, HOME_NET should be the list of IPs that you want to 
monitor as possible destinations for attacks.

EXTERNAL_NET should be the list of IPs that you want to monitor as possible 
sources of attack.



-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users