0

I am using snort to log all traffic on an interface

snort -i eth1 -l /interface/log/dir -b -U -m 112

With this command I manage to get ALL data which makes my log files very large.

Is there any way to tell snort only to output packets which come from or go to a certain list of subnets? (More than one)

1 Answer 1

0

Look at /etc/snort/snort.conf

You can define your home and external nets. Home nets are being ignored while external nets are being processed.

var HOME_NET [10.1.1.0/24,192.168.1.0/24]

you can easily extend this lists.

Afer you have defined your sensible and home nets, you can exclude rules you don't use or don't need to monitor.

include $RULE_PATH/local.rules
include $RULE_PATH/bad-traffic.rules
include $RULE_PATH/exploit.rules
include $RULE_PATH/community-exploit.rules
include $RULE_PATH/scan.rules
include $RULE_PATH/finger.rules
# include $RULE_PATH/ftp.rules
include $RULE_PATH/telnet.rules

Just uncomment the rules you don't need.

1
  • Thanks for the answer. HOME_NET controls the subnets that apply to rules. I am using snort to log all packets and record them to disk. What I need is for snort to filter out these packets before they are written to disk ( I am using snort as if it were a tcpdump instance ). I think BPF filters are the solution to this problem but I cant quite seem to get them to work for muliple nets. (something like net 192.168.2.0/24 and net 192.168.3.0/24 and host 192.168.0.1 Feb 27, 2014 at 10:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .