![snort logo](/images/snort-logo.png)
Snort mailing list archives
Re: Question on port lists and negation
From: Matt Kettler <mkettler () evi-inc com>
Date: Mon, 08 Oct 2007 16:57:57 -0400
Richard Bejtlich wrote:
Hello, As I mentioned to roesch and WuTang in IRC, I am playing with port lists and negation. Say I create this snort.conf: portvar MY_HTTP_PORTS [80,81,82,83,88,8000,8008,8080] alert tcp any any -> any !$MY_HTTP_PORTS (msg:"Example Not"; sid:4;)
port specs cannot be comma-delimited lists like that, IIRC. For ports you can specify: a port [80] a continuous range of ports [1:1023] or a negation of either of the above. But you cannot do things like [80,88]. That syntax only works for IP addresses. See also, the docs on port numbers in rules: http://www.snort.org/docs/snort_htmanuals/htmanual_2615/node153.html ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Question on port lists and negation Richard Bejtlich (Oct 08)
- Re: Question on port lists and negation Matt Kettler (Oct 08)
- Re: Question on port lists and negation Scott Dexter (Oct 08)
- Re: Question on port lists and negation Jeffrey Denton (Oct 08)
- Re: Question on port lists and negation Matthew Watchinski (Oct 08)
- Re: Question on port lists and negation Richard Bejtlich (Oct 08)
- Re: Question on port lists and negation Jason (Oct 08)
- Re: Question on port lists and negation Matt Kettler (Oct 09)
- Re: Question on port lists and negation Jason (Oct 09)
- Re: Question on port lists and negation Matt Kettler (Oct 09)
- Re: Question on port lists and negation Jason (Oct 09)
- Re: Question on port lists and negation Richard Bejtlich (Oct 08)
- Re: Question on port lists and negation Matt Kettler (Oct 08)
- Re: Question on port lists and negation John Curry (Oct 08)