Snort mailing list archives
Re: EXTERNAL_NET var acting strange
From: Florent <florent () arcimex com>
Date: Tue, 21 Aug 2001 16:06:11 +0200
The point is that in both of my configs, packets from 1.1.1.66 should not be logged - correct?
You're wrong 1.1.1.66 makes !1.1.1.0/24 False whereas 1.1.1.66 make !1.1.1.0/24 or !172.16.0.0/24 or !172.16.16.0/24 Right That's the beauty of the complicated Negation. I'll try to find what you want to do. I've just left school but I hardly remember this uggly logical rules for negation. Florent _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- EXTERNAL_NET var acting strange Scott Nursten (Aug 21)
- Re: EXTERNAL_NET var acting strange Florent (Aug 21)
- Re: EXTERNAL_NET var acting strange Scott Nursten (Aug 21)
- Re: EXTERNAL_NET var acting strange Florent (Aug 21)
- Message not available
- Re: EXTERNAL_NET var acting strange Florent (Aug 21)
- Re: EXTERNAL_NET var acting strange Scott Nursten (Aug 21)
- Re: EXTERNAL_NET var acting strange Scott Nursten (Aug 21)
- Re: EXTERNAL_NET var acting strange Florent (Aug 21)
- Re: EXTERNAL_NET var acting strange John Sage (Aug 21)
- Re: EXTERNAL_NET var acting strange Scott Nursten (Aug 21)
- Re: EXTERNAL_NET var acting strange Scott Nursten (Aug 21)
- Re: EXTERNAL_NET var acting strange Florent (Aug 21)
- Re: EXTERNAL_NET var acting strange Scott Nursten (Aug 21)