RE: snort variable to specify 2 networks and exclude one IP inside the network - How?

["Srinivas Katta" <skatta () ikaSystems com>]

Run snort with following syntax;

 

 

/usr/local/bin/snort -u snort-user-id  -g snort-group -i interfacename
-d -D  -c /etc/snort/snort.conf not host 155.200.2.10

 

Srinivas

 

________________________________

From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of Simon Yip
Sent: Friday, July 08, 2005 10:38 AM
To: snort-users () lists sourceforge net
Subject: [Snort-users] snort variable to specify 2 networks and exclude
one IP inside the network - How?

 

Hello

 

Suppose I have the variable HOME_NET= [155.200.2.0/24,155.200.3.0/24]
and I would like o specify in a rule to specify the host of HOME_NET
exclude the IP=155.200.2.10

Anyone knows the expression using the $HOME_NET and the above IP?
Thanks

 

Simon


 


This email may contain proprietary and confidential information and is sent for the intended recipient(s) only. If by 
an addressing or transmission error this email has been delivered to you, you are requested to delete it immediately. 
You are also hereby notified that any use, any form of reproduction, dissemination, copying, disclosure, modification, 
distribution and/or publication of this e-mail message, contents or its attachment(s) other than by its intended 
recipient(s) is strictly prohibited. All rights reserved ikaSystems CorporationR.