Snort mailing list archives
Any idea when multiple port support is coming?
From: Jason Haar <Jason.Haar () trimble co nz>
Date: Wed, 07 Dec 2005 16:00:37 +1300
Hi there Says it all really. From an efficiency perspective, I really need to be able to define things like var HTTP_PORTS 80,3128,8080 so that single rules can trigger on HTTP traffic that is both direct, and/or via a proxy. Currently this would involve converting something like the 1217 web-*.rules into over 3.5K... At the moment, I've had to turn tonnes of intranet rules from $HTTP_PORTS to "any" to effect the same change more efficiently - but now get whacked with tonnes of false positives on SMTP traffic (so now I've changed "any" to "!25" - but you get the drift) Any hint to when/if this feature will show up? -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 ------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Any idea when multiple port support is coming? Jason Haar (Dec 06)
- Re: Any idea when multiple port support is coming? Russ Starr (Dec 06)