Re: [Snort-users] filtering bridge

At 05:14 AM 10/21/2004, jvarlet@aressi.fr wrote:
>I would like to know if it is possible to use snort on a bridge.
>All uses of snort I made was built on ip adresses.
>
>But a bridge has no ip adress...

Snort doesn't care about wether or not the ethernet interface it uses has
an IP address or not.. See the "stealth" interface notes in the FAQ.

Snort just picks up raw ethernet frames with pcap. If tcpdump can grab
packets off it, so can snort.

However, you will need to set up HOME_NET and EXTERNAL_NET. In the case of
a bridge, I'd probably just set these both to "any".

Generally speaking, HOME_NET should be the list of IPs that you want to
monitor as possible destinations for attacks.

EXTERNAL_NET should be the list of IPs that you want to monitor as possible
sources of attack.



-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjourna...uidepromo.tmpl
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users