[Snort-users] snort variable to specify 2 networks and exclude one IP inside the network - How?
This is a discussion on [Snort-users] snort variable to specify 2 networks and exclude one IP inside the network - How? within the Snort forums, part of the System Security and Security Related category; This is a multi-part message in MIME format. ------=_NextPart_000_0037_01C5840D.A204C4F0 Content-Type: text/plain; charset="big5" Content-...
|
|||||||
| FAQ | Members List | Calendar | Search | Today's Posts | Mark Forums Read |
07-08-2005
|
|||
|
|||
[Snort-users] snort variable to specify 2 networks and exclude one IP inside the network - How?
This is a multi-part message in MIME format.
------=_NextPart_000_0037_01C5840D.A204C4F0 Content-Type: text/plain; charset="big5" Content-Transfer-Encoding: quoted-printable Hello Suppose I have the variable HOME_NET=3D [155.200.2.0/24,155.200.3.0/24] = and I would like o specify in a rule to specify the host of HOME_NET = exclude the IP=3D155.200.2.10 Anyone knows the expression using the $HOME_NET and the above IP? = Thanks Simon ------=_NextPart_000_0037_01C5840D.A204C4F0 Content-Type: text/html; charset="big5" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=3DContent-Type content=3D"text/html; charset=3Dbig5"> <META content=3D"MSHTML 6.00.2900.2668" name=3DGENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=3D#ffffff> <DIV><FONT size=3D2>Hello</FONT></DIV> <DIV><FONT size=3D2></FONT> </DIV> <DIV><FONT size=3D2>Suppose I have the variable </FONT><FONT = size=3D2>HOME_NET=3D=20 [155.200.2.0/24,155.200.3.0/24] and I would like o specify in a rule to = specify=20 the host of HOME_NET exclude the IP=3D155.200.2.10</FONT></DIV> <DIV><FONT size=3D2>Anyone knows the expression using the $HOME_NET and = the above=20 IP? Thanks</FONT></DIV> <DIV><FONT size=3D2></FONT> </DIV> <DIV><FONT size=3D2>Simon</FONT></DIV> <DIV><FONT size=3D2><BR> </DIV></FONT></BODY></HTML> ------=_NextPart_000_0037_01C5840D.A204C4F0-- ------------------------------------------------------- This SF.Net email is sponsored by the 'Do More With Dual!' webinar happening July 14 at 8am PDT/11am EDT. We invite you to explore the latest in dual core and dual graphics technology at this free one hour event hosted by HP, AMD, and NVIDIA. To register visit http://www.hp.com/go/dualwebinar _______________________________________________ Snort-users mailing list Snort-users@lists.sourceforge.net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/...fo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.p...st=snort-users 
|
Linear Mode
