Snort IDS tips for VARs a

Snort configuration -- Defining IP ranges of interest

The first set of variables in a typical snort.conf look like this:

    Requires Free Membership to View

var HOME_NET any
var EXTERNAL_NET any
var DNS_SERVERS $HOME_NET
var SMTP_SERVERS $HOME_NET
var HTTP_SERVERS $HOME_NET
var SQL_SERVERS $HOME_NET
var TELNET_SERVERS $HOME_NET
var SNMP_SERVERS $HOME_NET
var AIM_SERVERS [a long list of AOL IM servers]

These variables allow an operator to define IP addresses that Snort will reference when inspecting traffic. It's customary to set the HOME_NET variable to be the range of IP addresses that the operator wishes to monitor. For example:

var HOME_NET 192.168.2.0/24

Many leave EXTERNAL_NET as any, or chose it to be all those IP addresses not associated with the HOME_NET:

var EXTERNAL_NET !$HOME_NET

Specific servers or ranges of IPs can be defined for each of the following variables. For example:

var DNS_SERVERS [172.16.3.2,4.2.2.1]

The more accurately one defines these variables (listing specific Web servers, SMTP servers and so on) the more relevant the alerts Snort will produce. You may leave the default variables in place, but expect more alerts than you might wish to inspect.


Snort: Understanding the configuration file

 Introduction: Upgrade to Snort 2.6.1.2
 The snort.conf file
 Defining IP ranges of interest
 Defining ports of interest
 Core preprocessors
 Non-dynamic preprocessors
 Conclusion

About the author
Richard Bejtlich is founder of TaoSecurity, author of several books on network security monitoring, including Extrusion Detection: Security Monitoring for Internal Intrusions, and operator of the TaoSecurity blog.


This was first published in January 2007

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: