I am using snort to log all traffic on an interface

snort -i eth1 -l /interface/log/dir -b -U -m 112

With this command I manage to get ALL data which makes my log files very large.

Is there any way to tell snort only to output packets which come from or go to a certain list of subnets? (More than one)


Look at /etc/snort/snort.conf

You can define your home and external nets. Home nets are being ignored while external nets are being processed.

var HOME_NET [,]

you can easily extend this lists.

Afer you have defined your sensible and home nets, you can exclude rules you don't use or don't need to monitor.

include $RULE_PATH/local.rules
include $RULE_PATH/bad-traffic.rules
include $RULE_PATH/exploit.rules
include $RULE_PATH/community-exploit.rules
include $RULE_PATH/scan.rules
include $RULE_PATH/finger.rules
# include $RULE_PATH/ftp.rules
include $RULE_PATH/telnet.rules

Just uncomment the rules you don't need.

|improve this answer|||||
  • Thanks for the answer. HOME_NET controls the subnets that apply to rules. I am using snort to log all packets and record them to disk. What I need is for snort to filter out these packets before they are written to disk ( I am using snort as if it were a tcpdump instance ). I think BPF filters are the solution to this problem but I cant quite seem to get them to work for muliple nets. (something like net and net and host – user2284355 Feb 27 '14 at 10:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.