[Snort-users] Use of the var HOME_NET in a DMZ

I currently have a DMZ with multiple entry points and snort listening on
the internal interface of all of the entry points.  I also have snort
listening on the internal interface of the choke firewall.  I am
wondering what would be considered to be the best practice in terms of
configuring the HOME_NET variable.  Should each entry point have the DMZ
subnet set as the HOME_NET and the choke firewall have the internal
subnet(s) as the HOME_NET?  Or should the entry points and choke
firewall all have HOME_NET defined as the DMZ subnet and the internal
subnet(s)?

TIA

byron


-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users