OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
RE: [Snort-users] a lot of Loopback traffic being logged.

From: Matt Kettler (mkettlerevi-inc.com)
Date: Thu Apr 22 2004 - 12:28:20 CDT

At 12:58 PM 4/22/2004, Chuck Holley wrote:
>OK, I think im on to something. I do not use the -i option, only -c to look
>at the conf. in the conf I have for "HOME_NET 192.168.10.0/24" and a little
>further down I have "HOME_NET any"
>
>I didn't pay much attention to that earlier because they were both not
>commented out by default. Im still a little confused on how snort works. Is
>this the problem?

No, it's not a problem, If I remember correctly the duplicate definition
will just cause the second one to be used.

However HOME_NET has nothing to do with what traffic snort picks up.
HOME_NET is basically just a variable that get's substituted in various
places in the rules and parameters to the preprocessors. It's used to give
rules/code hints as to which end of a conversation is likely to be a part
of your network. HOME_NET changes the alerting behaviors of snort, but
doesn't change the low-level packet collection behaviors.

Things like -i tell snort which network interface to suck traffic in from.
This is a very low-level thing and changes what packets enter snort in the
first place.

-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users