From: Erek Adams (ereksnort.org)
Date: Tue Apr 08 2003 - 09:20:50 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Mon, 7 Apr 2003, Keg wrote:

> 1. I get it., but on the other hand my EXTERNAL_NET is set to ANY.
> Should that treat nessus box as external_net?

It should.

If you run Snort in sniffer mode, can you see traffic destined for the
Win32 box?

        snort -vd

> 2. Should I always use EXTERNAL_NET as !$HOME_NET?

That's up to you. I do it to cut down on false positives. Try it both
ways and see what works better for you.

-----
Erek Adams

   "When things get weird, the weird turn pro." H.S. Thompson

-------------------------------------------------------
This SF.net email is sponsored by: ValueWeb:
Dedicated Hosting for just $79/mo with 500 GB of bandwidth!
No other company gives more support or power for your dedicated server
http://click.atdmt.com/AFF/go/sdnxxaff00300020aff/direct/01/
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]