Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using snort to log all traffic on an interface

snort -i eth1 -l /interface/log/dir -b -U -m 112

With this command I manage to get ALL data which makes my log files very large.

Is there any way to tell snort only to output packets which come from or go to a certain list of subnets? (More than one)

share|improve this question

1 Answer 1

Look at /etc/snort/snort.conf

You can define your home and external nets. Home nets are being ignored while external nets are being processed.

var HOME_NET [10.1.1.0/24,192.168.1.0/24]

you can easily extend this lists.

Afer you have defined your sensible and home nets, you can exclude rules you don't use or don't need to monitor.

include $RULE_PATH/local.rules
include $RULE_PATH/bad-traffic.rules
include $RULE_PATH/exploit.rules
include $RULE_PATH/community-exploit.rules
include $RULE_PATH/scan.rules
include $RULE_PATH/finger.rules
# include $RULE_PATH/ftp.rules
include $RULE_PATH/telnet.rules

Just uncomment the rules you don't need.

share|improve this answer
    
Thanks for the answer. HOME_NET controls the subnets that apply to rules. I am using snort to log all packets and record them to disk. What I need is for snort to filter out these packets before they are written to disk ( I am using snort as if it were a tcpdump instance ). I think BPF filters are the solution to this problem but I cant quite seem to get them to work for muliple nets. (something like net 192.168.2.0/24 and net 192.168.3.0/24 and host 192.168.0.1 –  user2284355 Feb 27 at 10:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.