RE: [Snort-users] snort variable to specify 2 networks and exclude one IP inside the network - How?
This is a discussion on RE: [Snort-users] snort variable to specify 2 networks and exclude one IP inside the network - How? within the Snort forums, part of the System Security and Security Related category; This is a multi-part message in MIME format. ------_=_NextPart_001_01C583CE.F64634E8 Content-Type: text/plain; charset="us-ascii&...
|
|||||||
| FAQ | Members List | Calendar | Search | Today's Posts | Mark Forums Read |
07-08-2005
|
|||
|
|||
RE: [Snort-users] snort variable to specify 2 networks and exclude one IP inside the network - How?
This is a multi-part message in MIME format.
------_=_NextPart_001_01C583CE.F64634E8 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Oops. =20 I have thought in diff way. =20 Folks will help you Simon. =20 Thanks, Srinivas =20 =20 =20 ________________________________ From: snort-users-admin@lists.sourceforge.net [mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of Simon Yip Sent: Friday, July 08, 2005 10:38 AM To: snort-users@lists.sourceforge.net Subject: [Snort-users] snort variable to specify 2 networks and exclude one IP inside the network - How? =20 Hello =20 Suppose I have the variable HOME_NET=3D [155.200.2.0/24,155.200.3.0/24] and I would like o specify in a rule to specify the host of HOME_NET exclude the IP=3D155.200.2.10 Anyone knows the expression using the $HOME_NET and the above IP? Thanks =20 Simon =20 This email may contain proprietary and confidential information and is = sent for the intended recipient(s) only. If by an addressing or = transmission error this email has been delivered to you, you are = requested to delete it immediately. You are also hereby notified that = any use, any form of reproduction, dissemination, copying, disclosure, = modification, distribution and/or publication of this e-mail message, = contents or its attachment(s) other than by its intended recipient(s) is = strictly prohibited. All rights reserved ikaSystems CorporationR. ------_=_NextPart_001_01C583CE.F64634E8 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html> <head> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = charset=3Dus-ascii"> <meta name=3DGenerator content=3D"Microsoft Word 11 (filtered)"> <style> <!-- /* Font Definitions */ @font-face {font-family:PMingLiU; panose-1:2 1 6 1 0 1 1 1 1 1;} @font-face {font-family:Tahoma; panose-1:2 11 6 4 3 5 4 4 2 4;} @font-face {font-family:"\@PMingLiU"; panose-1:0 0 0 0 0 0 0 0 0 0;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; margin-bottom:.0001pt; font-size:12.0pt; font-family:PMingLiU;} a:link, span.MsoHyperlink {color:blue; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {color:purple; text-decoration:underline;} span.EmailStyle17 {font-family:Arial; color:navy;} @page Section1 {size:8.5in 11.0in; margin:1.0in 1.25in 1.0in 1.25in;} div.Section1 {page:Section1;} --> </style> </head> <body bgcolor=3Dwhite lang=3DEN-US link=3Dblue vlink=3Dpurple> <div class=3DSection1> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'>Oops.</span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'> </span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'>I have thought in diff = way.</span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'> </span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'>Folks will help you = Simon.</span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'> </span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'>Thanks,</span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'>Srinivas</span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'> </span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'> </span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'> </span></font></p> <div> <div class=3DMsoNormal align=3Dcenter style=3D'text-align:center'><font = size=3D3 face=3DPMingLiU><span style=3D'font-size:12.0pt'> <hr size=3D2 width=3D"100%" align=3Dcenter tabindex=3D-1> </span></font></div> <p class=3DMsoNormal><b><font size=3D2 face=3DTahoma><span = style=3D'font-size:10.0pt; font-family:Tahoma;font-weight:bold'>From:</span></font></b><font = size=3D2 face=3DTahoma><span style=3D'font-size:10.0pt;font-family:Tahoma'> snort-users-admin@lists.sourceforge.net [mailto:snort-users-admin@lists.sourceforge.net] <b><span = style=3D'font-weight: bold'>On Behalf Of </span></b>Simon Yip<br> <b><span style=3D'font-weight:bold'>Sent:</span></b> Friday, July 08, = 2005 10:38 AM<br> <b><span style=3D'font-weight:bold'>To:</span></b> snort-users@lists.sourceforge.net<br> <b><span style=3D'font-weight:bold'>Subject:</span></b> [Snort-users] = snort variable to specify 2 networks and exclude one IP inside the network - = How?</span></font></p> </div> <p class=3DMsoNormal><font size=3D3 face=3DPMingLiU><span = style=3D'font-size:12.0pt'> </span></font></p> <div> <p class=3DMsoNormal><font size=3D2 face=3DPMingLiU><span = style=3D'font-size:10.0pt'>Hello</span></font></p> </div> <div> <p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span = style=3D'font-size: 12.0pt;font-family:"Times New Roman"'> </span></font></p> </div> <div> <p class=3DMsoNormal><font size=3D2 face=3DPMingLiU><span = style=3D'font-size:10.0pt'>Suppose I have the variable HOME_NET=3D [155.200.2.0/24,155.200.3.0/24] and I = would like o specify in a rule to specify the host of HOME_NET exclude the = IP=3D155.200.2.10</span></font></p> </div> <div> <p class=3DMsoNormal><font size=3D2 face=3DPMingLiU><span = style=3D'font-size:10.0pt'>Anyone knows the expression using the $HOME_NET and the above = IP?</span></font><font size=3D2 face=3D"Times New Roman"><span = style=3D'font-size:10.0pt;font-family:"Times New = Roman"'> </span></font><font size=3D2><span style=3D'font-size:10.0pt'> Thanks</span></font></p> </div> <div> <p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span = style=3D'font-size: 12.0pt;font-family:"Times New Roman"'> </span></font></p> </div> <div> <p class=3DMsoNormal><font size=3D2 face=3DPMingLiU><span = style=3D'font-size:10.0pt'>Simon</span></font></p> </div> <div> <p class=3DMsoNormal><font size=3D2 face=3DPMingLiU><span = style=3D'font-size:10.0pt'><br> </span></font><font size=3D2 face=3D"Times New Roman"><span = style=3D'font-size:10.0pt; font-family:"Times New Roman"'> </span></font></p> </div> </div> </body> <!--[object_id=3D#ikasystems.com#]--><P class=3DMsoNormal = style=3D"MARGIN: 0in 0in 0pt"><FONT face=3D"Times New Roman"><FONT = color=3D#0000ff><FONT = size=3D3>***************************************** ***********************= ***********************************************</FONT></FONT></FONT></P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt"><FONT face=3D"Times = New Roman"><FONT color=3D#0000ff><FONT size=3D3>This email may contain = proprietary and confidential information and is sent for the intended = recipient(s) only. If by an addressing or transmission error this email = has been delivered to you, you are requested to delete it immediately. = You are also hereby notified that any use, any form of reproduction, = dissemination, copying, disclosure, modification, distribution and/or = publication of this e-mail message, contents or its attachment(s) other = than by its intended recipient(s) is strictly prohibited. All rights = reserved <I style=3D"mso-bidi-font-style: normal"><SPAN style=3D"COLOR: = red">i</SPAN></I>kaSystems Corporation</FONT><SUP><SPAN = style=3D"FONT-SIZE: 10pt">R</SPAN></SUP><FONT = size=3D3>.</FONT></FONT></FONT></P></html> ------_=_NextPart_001_01C583CE.F64634E8-- ------------------------------------------------------- This SF.Net email is sponsored by the 'Do More With Dual!' webinar happening July 14 at 8am PDT/11am EDT. We invite you to explore the latest in dual core and dual graphics technology at this free one hour event hosted by HP, AMD, and NVIDIA. To register visit http://www.hp.com/go/dualwebinar _______________________________________________ Snort-users mailing list Snort-users@lists.sourceforge.net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/...fo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.p...st=snort-users 
|
Linear Mode
