[Oisf-users] (no subject)

Leonard Jacobs ljacobs at netsecuris.com
Fri Jun 14 18:09:25 UTC 2013

The problem is you have both of those IP addresses in the same subnet with so is not in your EXTERNAL_NET.
Are you trying to trigger on outbound traffic?
Is HOST A on one interface and HOST B on another interface?  Where is HOST B trying to send traffic to?
From: oisf-users-bounces at openinfosecfoundation.org [mailto:oisf-users-bounces at openinfosecfoundation.org] On Behalf Of mouna amani
Sent: Friday, June 14, 2013 1:07 PM
To: oisf-users at openinfosecfoundation.org
Subject: [Oisf-users] (no subject)
here is the deal I am a beginner with ips and everything
I have a host A with ip
an Host B with ip
the HostB sometimes sends good traffic and sometimes attacks .
if my hostB decides to send bad traffic the ips will generate an alert??
 (I did not change the rules to drop)
or should I set EXTERNAL_NET to any
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20130614/a3e7793b/attachment-0002.html>

More information about the Oisf-users mailing list