Re: Net minus one address?

[Jason Brvenik <jasonb () sourcefire com>]

Rich Adamson wrote:
> Is there a way to specify a complete class-c network minus one address?
>
> Example: I want to monitor for all outgoing ftp sessions that happen
> from within an internal class-c to the external net, alerting on every 
> attempt except for one IP address. (It's acceptable for that one IP 
> address to pull anti-virus def's via ftp for this banking network.)
>
> Something like: 
>  var FTP_NET [10.1.2.0/24, !10.1.2.5]

You can use suppression or a pass rule to handle this case.

suppress - 
http://www.snort.org/docs/snort_htmanuals/htmanual_233/node13.html

pass -
http://www.snort.org/docs/snort_htmanuals/htmanual_233/node18.html


HTH.

> Other rules obviously need to watch the entire class-c, therefore it would
> seem like a filter for that IP wouldn't be appropriate.
>
> Thoughts?


-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users