RE: EXTERNAL_NET

["Don" <Don () WeberOnTheWeb com>]

that would be 
var HOME_NET [A.B.0.0/16]*
var EXTERNAL_NET !$HOME_NET
u cant forget the $ to identify it is using a variable that has been set


> > -----Original Message-----
> > From: snort-users-admin () lists sourceforge net
> > [mailto:snort-users-admin () lists sourceforge net]On Behalf Of Phil Wood
> > Sent: Saturday, June 22, 2002 11:11 PM
> > To: snort-users () lists sourceforge net
> > Subject: Re: [Snort-users] EXTERNAL_NET
> >
> >
> > On Sun, Jun 23, 2002 at 01:32:40AM -0400, Ashley Thomas wrote:
> > > Is it correct to say 
> > > var EXTERNAL_NET !A.B.0.0/8
> > >
> > > if i need to consider every ip except A.B.0.0 range as external ?
> >
> >  var HOME_NET [A.B.0.0/16]*
> >
> >  var EXTERNAL_NET !HOME_NET 
> >
> > The brackets allow for some more nets like:
> >
> >  var HOME_NET [A.B.0.0/16,192.168.1.0/24]
> >
> > > thanks 
> > > ashley
> > >
> > >
> > > -------------------------------------------------------
> > > Sponsored by:
> > > ThinkGeek at http://www.ThinkGeek.com/
> > > _______________________________________________
> > > Snort-users mailing list
> > > Snort-users () lists sourceforge net
> > > Go to this URL to change user options or unsubscribe:
> > > https://lists.sourceforge.net/lists/listinfo/snort-users
> > > Snort-users list archive:
> > > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> >
> > -- 
> > Phil Wood, cpw () lanl gov
> >
> >
> >
> > -------------------------------------------------------
> > Sponsored by:
> > ThinkGeek at http://www.ThinkGeek.com/
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
Sponsored by:
ThinkGeek at http://www.ThinkGeek.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users