Re: EXTERNAL_NET var acting strange

[John Sage <jsage () finchhaven com>]

Scott:

Have you tried:

var EXTERNAL_NET !$HOME_NET

(Not wanting to get involved in the ongoing logic-syntax debate... ;-)

- John

--
John Sage
FinchHaven, Vashon Island, WA, USA
http://www.finchhaven.com/
mailto:jsage () finchhaven com
"The web is so, like, five minutes ago..."


Scott Nursten wrote:

> Hi guys, 
>
> In my conf, I have the following (obfuscated live IP's): 
>
>
> -----snip------
> var HOME_NET 1.1.1.0/24
>
> # Set up the external network addresses as well.
> # A good start may be "any"
>
> var EXTERNAL_NET [!1.1.1.0/24,!172.16.0.0/24,!172.16.16.0/24]
> -----snip------
>
> However, ICMP packets from 1.1.1.66 -> 1.1.1.55 get logged through the following rule:
>
> icmp.rules:alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING NMAP"; dsize: 0; itype: 8; 
> reference:arachnids,162; classtype:attempted-recon; sid:469; rev:1;)
>
> If I change EXTERNAL_NET to !1.1.1.0/24 (without the ['s and ,'s), it worx fine (ie. those packets don't get logged). 
>
> Please point out the error. 
>
> Rgds,



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users