HOME_NET [ip1/32, ip2/32] is the proper format for 2 ip addresses (note the
addition of the /32 netmask). If you want to do a whole subnet, change the
/32 to the appropriate netmask size.

As far as the switched ethernet goes, if you're using an ethernet switch
instead of a hub on your network your snort box will not see the traffic
being sent to other machines. An ethernet switch is a somewhat intelligent
version of a hub that automatically builds tables of what MAC addresses are
on each port, based on past traffic. When a normal unicast packet comes
into a switch, it will only go out the one port which has that machine
connected to it. This greatly reduces collisions and improves network
performance.

Thus a snort sensor on a different switch will not be able to see most
traffic bound for other machines on other switch ports. A hub on the other
hand echoes traffic to all of its outbound ports, so the snort machine will
see traffic bound for it's neighbors, but that increases collisions and
reduces network performance.

I've mentioned on the list before that I use a setup like the one below to
monitor all traffic to-and-from the internet on my network and should work
well for any less-than 3mbit/sec internet connection. I'm using fairly
conservative numbers so that the 10mbit hub is no problem, any more than
3mbit in both directions simultaneously and the hub could get collision
saturated depending on what's going on. It could also work very well up to
6-8mbit/sec if it's almost all going in one direction.

(internet router)
      |
      |
(10mbit hub) ---- snort sensor
      |
      |
(ethernet switch)
   / | \
(various workstations)

If you have a faster line, use a 100mbit hub and that should carry up to
20-30mbit/sec in both directions, but make sure all the ports are set up
with 100mbit links, don't rely on the "10/100 auto-switching" feature of
some hubs. If you have a faster setup still, get a high-end switch with a
mirror port, but if you're running a T3 or better you should already know
this kind of equipment.

At 09:45 AM 6/3/2002 +0200, Salvatore Basso wrote:
>Hello, thanks for the answer...
>therefore I must modify the file snort.conf therefore:
>var HOME_NET [ ip1, ip2 ]
>just?
>excuse but I must makes an other question you, what you mean for:
>NOT * on to switched ethernet port ? thanks.
>
> -Salvatore.
>
>
>----- Original Message -----
>From: "matt" <mkettlerevi-inc.com>
>To: "Salvatore Basso" <sasabpixteam.com>;
><snort-userslists.sourceforge.net>
>Sent: Saturday, June 01, 2002 10:22 PM
>Subject: Re: [Snort-users] Multiple IP
>
>
> > Modify the HOME_NET variable in snort.conf, and make sure that you are
> > *NOT* on a switched ethernet port. (if you're switched, traffic for other
> > machines won't show up on your ethernet port, so it won't matter how snort
> > is configured.)
> >
> > That's all you should need to do on a *NIX setup, and I assume there's
> > nothing extra for Win32, but that's a bit of a strange build that I've not
> > used so I cannot speak conclusively on the matter.
> >
> >
> > At 06:55 PM 5/31/2002 +0200, Salvatore Basso wrote:
> > >Hi, I use the version for windows, and have the requirement of monitoring
> > >more IP addresses, have read that it must modify the file of
>configuration
> > >but in which point? thanks.
> > >
> > > -Salvatore.
> >
> >

_______________________________________________________________

Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm

_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]