|
|
|
|
Snort Forums Archive
Archive Home » Snort Advanced » Rule to detect out of range IP
Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.
[ Notice: Full Version of This Topic ]
Rule to detect out of range IP
Posted by toastmaster on April 25, 2005 09:23:54
Hello,
I am wondering if it is possible to make a rule that would detect when a computer on our internal network is using an IP address that is not within our assigned range of DHCP addresses. For Example, our internal addresses start with 172, I would like to make a rule that would notify me if someone on the network has a 192 IP or something like that. Please help, I'm a n00b. Thanks in advance. |
|
Posted by bfranklin on April 26, 2005 08:53:07
This won't catch everything, but it's at least a quick start. Define your $HOME_NET variable and alert ip !$HOME_NET any -> !$HOME_NET any. Note, this rule, as is, will crush snort if it's under any serious traffic load. |
|
Posted by toastmaster on May 06, 2005 16:40:18
Cool, Thanks for the reply. I will try that. |
|
|
|
|
|
