Re: [Snort-sigs] variable

Quoting Jules <jules@visionintel.com>:

> Hi there,
>
>
>
> Just wondering if after installing snort, one has to set up the variable
> such as $HOME_NET  for snort to run successfully?

it's not optional.  for openers, set HOME_NET like this:

var HOME_NET [10.0.0.0/8,192.168.0.0/16,172.16.0.0/12]

Then add your DMZ is your DMZ has an address range that is not covered  
by the above:

var HOME_NET [10.0.0.0/8,192.168.0.0/16,172.16.0.0/12,123.45.67.0/28]

You need to set SMTP_SERVERS to your email server iff you run  
pop3/imap/smtp inside your network.

You must set DNS_SERVERS to your DNS servers.

If you do not set these three at an absolute minimum your IDS will  
become mostly inert.

t.rains

-------------------------------------------------
Email solutions, MS Exchange alternatives and extrication,
security services, systems integration.
Contact:    services@doctorunix.com



-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs