4

I'm configuring Snort on Windows 7 with the help of this guy and I'm stuck at the following line in the config file:

List of DNS servers on your network.

I have multiple, how do I separate them? Spaces, tabs, commas or something else?

  • 1
    If you would like an easier process of setting up Snort, check out security-onion. It comes with a variety of tools to work with Snort, such as the GUI Snorby. securityonion.blogspot.com – user6255 Feb 13 '12 at 22:12
4

Just incase anyone stumbles across this in the future, further down the conf file there are other lists, all of which are contained in square brackets.

For listing ports, you seperate these with commas. For listing IP addresses, you seperate these with commas also, however you need to put down the IP address, followed by a slash, followed by the base.

So my final solution was like so:

[1.1.1.1/24,2.2.2.2/24]

  • 1
    You only need to include the mask if you are explicitly declaring a network block. Otherwise a /32 is assumed. – Scott Pack Jun 20 '12 at 13:05
  • Thanks, if you want to answer the question with more detail I will consider unaccepting my own answer and accepting yours – JMK Jun 20 '12 at 13:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.