Snort mailing list archives
RE: HTTP PORTS
From: "Morgan R. Elmore" <Morgan () SEEMAC COM>
Date: Tue, 4 Feb 2003 14:09:07 -0500
Sorry for the bad info... That's what I get for ASSuming...LOL -----Original Message----- From: Matt Kettler [mailto:mkettler () evi-inc com] Sent: Tuesday, February 04, 2003 11:56 AM To: snort-users () lists sourceforge net Subject: RE: [Snort-users] HTTP PORTS AFAIK snort supports comma delimited lists for IPs but they are NOT supported for ports. Thus currently you can specify HTTP_PORTS as a single port, as a range (ie: HTTP_PORTS [80:88]) or as a negation of either of the above (ie: !25 or ![20:25]), but [80,8080] is NOT supported. See the docs for details on specifying ports in rules: http://www.snort.org/docs/writing_rules/chap2.html#tth_sEc2.2.4 At 10:56 AM 2/4/2003 -0500, Morgan R. Elmore wrote:
I believe the correct way to specify multiple ports would be: var HTTP_PORTS [80,8080] -----Original Message----- From: Darrin Powell [mailto:dpowell () lssi net] Sent: Tuesday, February 04, 2003 9:35 AM To: snort-users () lists sourceforge net Subject: [Snort-users] HTTP PORTS Is this the correct way to set HTTP_PORTS? # Ports you run web servers on var HTTP_PORTS 80 8080 Thanks Darrin ------------------------------------------------------- This SF.NET email is sponsored by: SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See! http://www.vasoftware.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- This SF.NET email is sponsored by: SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See! http://www.vasoftware.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- This SF.NET email is sponsored by: SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See! http://www.vasoftware.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- This SF.NET email is sponsored by: SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See! http://www.vasoftware.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- HTTP PORTS Darrin Powell (Feb 04)
- <Possible follow-ups>
- RE: HTTP PORTS Morgan R. Elmore (Feb 04)
- Re: HTTP PORTS Chris Green (Feb 04)
- Re: HTTP PORTS Andrew R. Baker (Feb 04)
- RE: HTTP PORTS Matt Kettler (Feb 04)
- RE: HTTP PORTS Morgan R. Elmore (Feb 04)