Carlos wrote:
hello, this is my fist email to this list. My name Carlos. i have a great problem for configuring snort: my internet ip is XX.XX.XX.XX - mask: 255.255.255.128 my local net is 192.168.1.10 mask: 255.255.255.0
what must i to writte, for configuring snort, in the: var HOME_NET and in: var EXTERNAL_NET ??
Well, you should use in the HOME_NET the network address you whish to protect (the one to watch for attacks), so in that one you should place your ip's (i am assuming that your internet ip is a gateway for your network) var HOME_NET [xxx.xxx.xxx.xxx/32 192.168.1.0/24] That way you are protecting both your external ip and also your internal ip, if you are using NAT you probably can only use for HOME_NET your external ip. As for your EXTERNAL_NET, you can use "any" (without the quotes) or and i haven't tried it myself !HOME_NET.
thanks for reading this mail Carlos
Hope this helps. Jose Araujo