Re: Ignoring arbitrary ports for certain rules

["AJ Butcher, Information Systems and Computing" <Alex.Butcher () bristol ac uk>]

--On 20 May 2004 12:56 -0400 Matt Kettler <mkettler () evi-inc com> wrote:

> At 06:36 AM 5/20/2004, AJ Butcher, Information Systems and Computing
> wrote:
> > var P2P_PORTS [5541,6346:6352,6881:6884]
> >
> > and then use something like:
> >
> > alert tcp any !P2P_PORTS <> $HOME_NET !P2P_PORTS ...
> >
> > I can't seem to find any syntax (spaces, commas, square brackets) to
> > allow  this, and in fact, I suspect it isn't possible. Can anyone
> > confirm or deny  this?
>
> I can confirm it's not possible. IP addresses can have comma-delimited
> discontinuous lists, but ports cannot.
>
> You can do a port, a range or a negation of either a port or a range, but
> that's it.
>
> The legal syntax is documented in section 2.2.4 of the manual:
> http://www.snort.org/docs/snort_manual/node11.html#SECTION003240000000000
> 00000

That's what I was thinking. Thanks for the confirmation.

Does anyone have smarter strategies than:

a) using a BPF filter to "blind" the IDS to traffic involving one or more 
well-known P2P port.

or -

b) creating a number of "pass" rules for each affected rule.

?

Best Regards,
Alex.
--
Alex Butcher: Security & Integrity, Personal Computer Systems Group
Information Systems and Computing             GPG Key ID: F9B27DC9
GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9




-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g. 
Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users