Snort mailing list archives

RE: Antwort: IP Range Problems


From: Steve Halligan <shalligan () 333tech com>
Date: Wed, 6 Aug 2003 10:45:25 -0500

Foiled again by bitmath, Erek is (as usual) absolutely correct. 
On Wed, 6 Aug 2003, SRH-Lists wrote:

That last suggestion would really represent 10.5.0.1 - 
10.5.7.255, which
is slightly more that the requested range.

Err....  Ummm...  Not quite.  It gets you 10.5.0.0-10.5.3.255

The earlier suggestion of var HOME_NET
[10.5.0.0/24,10.5.0.1/24,10.5.0.2/24,10.5.0.3/24,10.5.0.4/24] would
work,

Yes, it will.  It's also going to increase the overhead that 
Snort has to
deal with.  Smaller CIDR == Faster Snort.  :)

but to get lazy and reduce typing:
var HOME_NET [10.5.0.0/23,10.5.4.0/24]

s/3/2/  :)

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson



-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: