Snort configuration question.

reesee · 04-13-2004, 03:37 PM

Hello
I am attempting to get snort going, I have it installed with acid but I am not geting any readings at all. I tried scanning myself with nmap but got nothing. I think it may have something to do with the var HOME_NET line in my snork.conf file. Are they looking for my ip and subnet mask there? I have everything running on one computer.

Thanks for the help.

ugge · 04-13-2004, 04:58 PM

Yes they look for your LAN IP and netmask.

action09 · 01-26-2006, 04:23 PM

Yes but if the PC is directly connected to an ADSL modem and has only one ethernet card ?

No router, only one ethernet connected to a modem ?

what would you put my eth0 has only one public IP address....

e.g.
var HOME_NET 82.19.5.X/32 ?

TIA

action09 · 01-26-2006, 04:26 PM

I'm not sure but maybe i can set HOME_NET and EXTERNAL_NET variables to 'any' ... and i won't loose anything... correct ?