snort

[mohdfarah]

salam
I use snort as IDS but i am not profissional at it ,i want it to monitoring specific IP with specific port

[brandor]

Check the snort documentation.

[mohdfarah]

may ask quesiton ? what is the purpose of Forum?what about other experince ?experince

[brandor]

The purpose of the forum is to find help from other users. It's not for answering simple questions that are easily accessible in the documentation.

It took me all of 15 seconds to find out how to do what you're asking by looking at the documentation.

Take a few minutes and check out this thread. It's stickied at the top of this forum.
http://forums.fedoraforum.org/showthread.php?t=119759

[mohdfarah]

but some times the document is complex and not clear enough for biggener .anyhow thank you for your advice.

[stanjam]

I believe you can do this by madifying your snort.conf file. I think modifying your line:
var HOME_NET 10.0.0.0/24 (make this what ever your internal network is, use CIDR.

to name either your eth0 device or your IP address.

There is a good primer on getting snort and BASE (which I highly reccomend) to run on:
http://www.internetsecurityguru.com