Re: Rule header variables

[Erick Mechler <emechler () techometer net>]

:: Can a rule header specify all traffic except a few subnets or hosts? In this
:: example can the source have variables to exclude a few subnets or hosts? 
::  
:: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"GAMBLING
:: GAMES";content:"GAMBLING"; nocase; flow:to_client,established; sid:20000;
:: rev:1000;)

Sure it can.  Check the Snort Users Manual on how to do exactly this.


-------------------------------------------------------
This SF.net email is sponsored by: Scholarships for Techies!
Can't afford IT training? All 2003 ictp students receive scholarships.
Get hands-on training in Microsoft, Cisco, Sun, Linux/UNIX, and more.
www.ictp.com/training/sourceforge.asp
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users