How to use a list of ports but not a range?

["Kohlenberg, Toby" <toby.kohlenberg () intel com>]

I'm trying to figure out how to write a rule that will allow me to
specify more than one port but not all the ones in between (e.g. the
":" syntax won't work). The problem I'm running into is that a
number of rules keep falsing against our HTTPS site, which uses 443.
I've searched the docs but can't find any reference to whether the
list functionality that exists for addresses also exists for ports.

I'm toying with the idea of re-writing the rules as "activate" and then
activating an identical rule with the port changed, but that seems like
a clumsy way of doing it.

Any suggestions? Did I miss something obvious?

Thanks,
Toby


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users