I have used snort for traffic analysis quite often and it worked fine as it generates rules that are corresponding to packets doing malicious activities on my
HOME_NET which is always private addresses.
This time I have given a pcap file where traffic was captured from a NET enabled firewall, so no private addresses were in that traffic as they were masked by public address scheme say [22.214.171.124/24]. Now I needed to change snort.conf file so that it consider this address scheme as its
HOME_NET which I did. I changed
HOME_NET variable to
[126.96.36.199/24]. But snort is not generating any alert since then. The only alerts I have been seeing are invoked by
HOME_NET->EXTERNAL_NET or vice versa are not working.
Can't I give public addresses to HOME_NET variable?