Re: Snort RULES and Variables want to kill me!

[Alessandro Salvatori <a.salvatori () universitari crocetta org>]

De Morgan docet...

NOT ( A OR B OR C ) = ( NOT A ) AND ( NOT B ) AND ( NOT C ) != NOT ( A ) OR NOT ( B ) OR NOT ( C )

the latter is (almost) always true...
cheers
sandr8)

On Sun, 24 Aug 2003 19:20:36 -0500
Paul Schmehl <pauls () utdallas edu> wrote:

> --On Sunday, August 24, 2003 6:45 PM -0500 Jake Schneider 
> <j4k3 () charter net> wrote:
> > Hello I have a rule set that wants to eat me, well actually it's probably
> > more of my own misunderstanding than anything, but could anyone give me
> > some insight in to my situation?
> >
> > I have in my snort.conf defined EXTERNAL_NET like this;
> >
> > var EXTERNAL_NET [!192.168.0.0/24,!192.168.1.0/24,!192.168.2.0]
> >
> > Apparently I'm missing something.
> You are.  The obvious.
>
> $HOME_NET = [192.168.0.0/24,192.168.1.0/24,192.168.2.0/24]
> $EXTERNAL NET = !$HOME_NET
>
> Paul Schmehl (pauls () utdallas edu)
> Adjunct Information Security Officer
> The University of Texas at Dallas
> AVIEN Founding Member
> http://www.utdallas.edu
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: VM Ware
> With VMware you can run multiple operating systems on a single machine.
> WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines
> at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This SF.net email is sponsored by: VM Ware
With VMware you can run multiple operating systems on a single machine.
WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines
at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users