Snort question: snort.debian.conf and snort.conf's home_net
I was going to set up snort on the firewall that I'm using, but I was a
bit dumbfounded by the fact that dpkg seems to make a config file called
snort.debian.conf that has a home_net and snort.conf has it's own home_net.
My question is, should I set the home_net both to the external device,
the internal device, or any other combination?
Also, how can I make it that if it's configured for the external device
only, it wouldn't be in promiscuous mode because it doesn't need to be?
Calyth
Reply to: