Re: Snort Rules & Variables

[Joel Esler <eslerj () gmail com>]

And you can either have CIDR or not have CIDR, but you have to  
eliminate your space, as Bruce said.

Joel


On Jul 7, 2005, at 5:10 PM, Briggs, Bruce wrote:

> You can have a comma separated list, no spaces, within brackets.
> MAIL_SOURCES:  [111.222.222.24,111.222.225.10]
>
> Bruce
>
> From: snort-users-admin () lists sourceforge net [mailto:snort-users- 
> admin () lists sourceforge net] On Behalf Of Pennell, Ronald B.
> Sent: Thursday, July 07, 2005 3:01 PM
> To: snort-users () lists sourceforge net
> Subject: [Snort-users] Snort Rules & Variables
>
> When using a variable to specify specific IP addresses can you just  
> list the IP addresses themselves without the range?
>
>
>
> Ie:  MAIL_SOURCES:  [111.222.222.24, 111.222.225.10] – or do you  
> need to specify the CIDR as part of the address?
>
>
>
> Ron