0

I have used snort for traffic analysis quite often and it worked fine as it generates rules that are corresponding to packets doing malicious activities on my HOME_NET which is always private addresses.

This time I have given a pcap file where traffic was captured from a NET enabled firewall, so no private addresses were in that traffic as they were masked by public address scheme say [1.1.1.0/24]. Now I needed to change snort.conf file so that it consider this address scheme as its HOME_NET which I did. I changed HOME_NET variable to [1.1.1.0/24]. But snort is not generating any alert since then. The only alerts I have been seeing are invoked by any->any rules. HOME_NET->EXTERNAL_NET or vice versa are not working.

Can't I give public addresses to HOME_NET variable?

Thanks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.