I have used snort for traffic analysis quite often and it worked fine as it generates rules that are corresponding to packets doing malicious activities on my HOME_NET which is always private addresses.

This time I have given a pcap file where traffic was captured from a NET enabled firewall, so no private addresses were in that traffic as they were masked by public address scheme say []. Now I needed to change snort.conf file so that it consider this address scheme as its HOME_NET which I did. I changed HOME_NET variable to []. But snort is not generating any alert since then. The only alerts I have been seeing are invoked by any->any rules. HOME_NET->EXTERNAL_NET or vice versa are not working.

Can't I give public addresses to HOME_NET variable?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.