Re: Question about negated and non-negated variables in rules

["J-H. Johansen" <corinth () online no>]

Matt Kettler wrote:

> At 06:24 AM 11/29/2003, Jens-Harald Johansen wrote:
>
> > But if I understand you correctly, I need to create pass rules for the 
> > hosts which are allowed to run the ICMP traffic ? Think I'll need to 
> > RTFM concerning pass rules. Haven't used them before.
>
>
> pass rules are pretty straight forward, just make sure you pass the -o 
> parameter to snort's command line.
>
> Also think your pass rules through carefully.. make sure you don't wind 
> up with a rule that is the equivalent of "pass any any -> any any".

After reading a bit I ended up with a pass rule like below:

pass icmp $ICMP_WHITELIST any -> $HOME_NET any (dsize: >800; sid:499;)


I kept the sid in order to know what alert rule I'm letting pass.

Thanks for the help

jens:H


-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive?  Does it
help you create better code?  SHARE THE LOVE, and help us help
YOU!  Click Here: http://sourceforge.net/donate/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users