RE: [Snort-users] Snort Rules & Variables
This is a discussion on RE: [Snort-users] Snort Rules & Variables within the Snort forums, part of the System Security and Security Related category; This is a multi-part message in MIME format. ------_=_NextPart_001_01C58338.3DAC1912 Content-Type: text/plain; charset="US-ASCII&...
|
|||||||
| FAQ | Members List | Calendar | Search | Today's Posts | Mark Forums Read |
07-07-2005
|
|||
|
|||
RE: [Snort-users] Snort Rules & Variables
This is a multi-part message in MIME format.
------_=_NextPart_001_01C58338.3DAC1912 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable You can have a comma separated list, no spaces, within brackets. MAIL_SOURCES: [111.222.222.24,111.222.225.10]=20 =20 Bruce _____ =20 From: snort-users-admin@lists.sourceforge.net [mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of Pennell, Ronald B. Sent: Thursday, July 07, 2005 3:01 PM To: snort-users@lists.sourceforge.net Subject: [Snort-users] Snort Rules & Variables When using a variable to specify specific IP addresses can you just list the IP addresses themselves without the range? =20 Ie: MAIL_SOURCES: [111.222.222.24, 111.222.225.10] - or do you need to specify the CIDR as part of the address? =20 Ron ------_=_NextPart_001_01C58338.3DAC1912 Content-Type: text/html; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML xmlns=3D"http://www.w3.org/TR/REC-html40" xmlns:o =3D=20 "urn:schemas-microsoft-com:office:office" xmlns:w =3D=20 "urn:schemas-microsoft-com:office:word"><HEAD> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Dus-ascii"> <META content=3D"MSHTML 6.00.2900.2668" name=3DGENERATOR> <STYLE> <!-- /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; margin-bottom:.0001pt; font-size:12.0pt; font-family:"Times New Roman";} a:link, span.MsoHyperlink {color:blue; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {color:purple; text-decoration:underline;} span.EmailStyle17 {mso-style-type:personal-compose; font-family:Arial; color:windowtext;} @page Section1 {size:8.5in 11.0in; margin:1.0in 1.25in 1.0in 1.25in;} div.Section1 {page:Section1;} --> </STYLE> </HEAD> <BODY lang=3DEN-US vLink=3Dpurple link=3Dblue> <DIV dir=3Dltr align=3Dleft><SPAN class=3D304180021-07072005><FONT = face=3DArial=20 color=3D#0000ff size=3D2>You can have a comma separated list, no spaces, = within=20 brackets.</FONT></SPAN></DIV> <DIV dir=3Dltr align=3Dleft><SPAN class=3D304180021-07072005><FONT = face=3DArial=20 size=3D2>MAIL_SOURCES: [111.222.222.24,111.222.225.10] = </FONT></SPAN></DIV> <DIV dir=3Dltr align=3Dleft><SPAN class=3D304180021-07072005><FONT = face=3DArial=20 size=3D2></FONT></SPAN> </DIV> <DIV dir=3Dltr align=3Dleft><SPAN class=3D304180021-07072005><FONT = face=3DArial=20 size=3D2>Bruce</FONT></SPAN></DIV><BR> <DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr align=3Dleft> <HR tabIndex=3D-1> <FONT face=3DTahoma size=3D2><B>From:</B> = snort-users-admin@lists.sourceforge.net=20 [mailto:snort-users-admin@lists.sourceforge.net] <B>On Behalf Of = </B>Pennell,=20 Ronald B.<BR><B>Sent:</B> Thursday, July 07, 2005 3:01 PM<BR><B>To:</B>=20 snort-users@lists.sourceforge.net<BR><B>Subject:</B> [Snort-users] Snort = Rules=20 & Variables<BR></FONT><BR></DIV> <DIV></DIV> <DIV class=3DSection1> <P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20 style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">When using a variable to = specify=20 specific IP addresses can you just list the IP addresses themselves = without the=20 range?<o:p></o:p></SPAN></FONT></P> <P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20 style=3D"FONT-SIZE: 10pt; FONT-FAMILY: = Arial"><o:p> </o:p></SPAN></FONT></P> <P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20 style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Ie: = MAIL_SOURCES: =20 [111.222.222.24, 111.222.225.10] – or do you need to specify the = CIDR as part of=20 the address?<o:p></o:p></SPAN></FONT></P> <P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20 style=3D"FONT-SIZE: 10pt; FONT-FAMILY: = Arial"><o:p> </o:p></SPAN></FONT></P> <P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20 style=3D"FONT-SIZE: 10pt; FONT-FAMILY: = Arial">Ron<o:p></o:p></SPAN></FONT></P></DIV></BODY></HTML> ------_=_NextPart_001_01C58338.3DAC1912-- ------------------------------------------------------- This SF.Net email is sponsored by the 'Do More With Dual!' webinar happening July 14 at 8am PDT/11am EDT. We invite you to explore the latest in dual core and dual graphics technology at this free one hour event hosted by HP, AMD, and NVIDIA. To register visit http://www.hp.com/go/dualwebinar _______________________________________________ Snort-users mailing list Snort-users@lists.sourceforge.net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/...fo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.p...st=snort-users 
|
Linear Mode
