My first sensor runs outside firewall and it displays a lot of alerts.
The second sensor is placed inside my network and monitors firewall aln nic.
It displays very few alerts (in fact only alerts from our external dns
servers are displayed as a port scans)
Is that normal? I mean is that normal that I almost don't see alerts inside
my lan?

_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]