Re: -S and ipvar vs. var

[Steve Gantz <stephen.gantz () faculty umuc edu>]

Current Snort manual says all IP variables are to be specified with ipvar, so I would expect that would include 
HOME_NET. I think you want to be using -h as the command line option to pass the value of HOME_NET. 


Dr. Stephen D. Gantz, CISSP-ISSAP, CEH, CGEIT, CRISC, CIPP/G, C|CISO

Professor of Information Assurance

The Graduate School

University of Maryland University College

stephen.gantz () faculty umuc edu



> On Jul 22, 2014, at 1:30 PM, Duane Howard <duane.security () gmail com> wrote:
>
> Hey folks,
>
> I've got a need to move HOME_NET to being passed on the command line using -S HOME_NET="blah" and I'm wondering if 
> this will internally be treated as a 'var' or 'ipvar' and whether it matters at all. Is there a mechanism to say -S 
> 'ipvar HOME_NET'='blah'?
>
> ./d
> ------------------------------------------------------------------------------
> Want fast and easy access to all the code in your enterprise? Index and
> search up to 200,000 lines of code with a free copy of Black Duck
> Code Sight - the same software that powers the world's largest code
> search on Ohloh, the Black Duck Open Hub! Try it now.
> http://p.sf.net/sfu/bds
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
------------------------------------------------------------------------------
Want fast and easy access to all the code in your enterprise? Index and
search up to 200,000 lines of code with a free copy of Black Duck
Code Sight - the same software that powers the world's largest code
search on Ohloh, the Black Duck Open Hub! Try it now.
http://p.sf.net/sfu/bds

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!