I am using snort
to log all traffic on an interface
snort -i eth1 -l /interface/log/dir -b -U -m 112
With this command I manage to get ALL data which makes my log files very large.
Is there any way to tell snort only to output packets which come from or go to a certain list of subnets? (More than one)
Best Answer
Look at
/etc/snort/snort.conf
You can define your home and external nets. Home nets are being ignored while external nets are being processed.
you can easily extend this lists.
Afer you have defined your sensible and home nets, you can exclude rules you don't use or don't need to monitor.
Just uncomment the rules you don't need.