EXTERNAL_NET var acting strange

[Scott Nursten <scott.nursten () StreetsOnline co uk>]

Hi guys, 

In my conf, I have the following (obfuscated live IP's): 


-----snip------
var HOME_NET 1.1.1.0/24

# Set up the external network addresses as well.
# A good start may be "any"

var EXTERNAL_NET [!1.1.1.0/24,!172.16.0.0/24,!172.16.16.0/24]
-----snip------

However, ICMP packets from 1.1.1.66 -> 1.1.1.55 get logged through the following rule:

icmp.rules:alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING NMAP"; dsize: 0; itype: 8; 
reference:arachnids,162; classtype:attempted-recon; sid:469; rev:1;)

If I change EXTERNAL_NET to !1.1.1.0/24 (without the ['s and ,'s), it worx fine (ie. those packets don't get logged). 

Please point out the error. 

Rgds,

-- 

Scott Nursten - Systems Administrator
----------------------------------------------
ddi:   +44 (0) 1293 744 122
work:  +44 (0) 1293 402 040
fax:   +44 (0) 1293 402 050
email: scottn () streetsonline co uk
wwweb: http://www.streetsonline.co.uk
----------------------------------------------

                Any sufficiently advanced technology is indistinguishable from magic.
                                        Arthur C. Clarke

                Any technology distinguishable from magic is insufficiently advanced.
                         (Probably not) Arthur C. Clarke

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users