IP Address's in Rule

["Mike McCabe" <mike () whiskerdreams net>]

How do I include specific IP addresses in a rule.  Say I want to have
certain IP addresses not looked at and still want the rule to use
EXTERNAL_NET...  Something like:

alert tcp [!X.Y.W.Z/32,!A.B.C.D/32,!E.F.G.H/32,$EXTERNAL_NET] any ->
$HOME_NET 53 (msg:"DNS zone transfer"; content: "|00 00 FC|"; flags: A+;
offset: 13; reference:arachnids,212; classtype:attempted-recon; sid:255;
rev:2;)

But it doesn't seem to work...

Any help would be appreciated...

Mike



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users