Snort mailing list archives
What is the best way to enable different rules for different subnets in Snort?
From: Alptugay Değrimencioğlu <alptugay () labrisnetworks com>
Date: Mon, 10 Aug 2015 13:04:33 +0300
We have snort running on one of our servers which has a network interface that has a subnet configuration of |192.168.0.0/16| I want to enable a specific rule, for example a chat rule with the sid:2002027, to |192.168.1.0/24| but I don't want the rule be active for |192.168.2.0/24|. What is the best way to achieve this?
|alert tcp any 6666:7000 -> any any (msg:"ET CHAT IRC PING command"; flow:from_server,established; content:"PING|20|"; depth:5; flowbits:set,is_proto_irc; reference:url,doc.emergingthreats.net/2002027; classtype:misc-activity; sid:2002027; rev:13;) |And also, the any keyword like the one in the above rule should be limited to |192.168.1.0/24|. Otherwise it would affect |192.168.2.0/24|. And I am trying to automate this because we can have many subnets and many different rules for these subnets.
Any advice would be great
------------------------------------------------------------------------------
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- What is the best way to enable different rules for different subnets in Snort? Alptugay Değrimencioğlu (Aug 10)
- Re: What is the best way to enable different rules for different subnets in Snort? Al Lewis (allewi) (Aug 10)