Snort mailing list archives
Re: Query on the format of 'icode' and 'itype' options
From: "Justin Heath" <justin.heath () gmail com>
Date: Wed, 4 Apr 2007 10:48:50 -0400
Suresh, This syntax is technically invalid. The range portion of your construct is going to be ignored using this syntax. For example, itype:> x <> y will be evaluated as itype:> x. Thanks, Justin Heath On 4/4/07, Suresh Kumar J <suresh.kumar.j () gmail com> wrote:
I wanted to hear from the Snort developers/experts about the validity of the following usages of 'itype' and 'icode' constructs. These options are accepted by the Snort 2.6 tool, but am not sure if they make any sense: itype:> x <> y itype:< x <> y itype:> x > y itype:< x < y --Suresh On 4/4/07, Joel Esler <joel.esler () sourcefire com> wrote:When in doubt, test it out! On Wed, Apr 04, 2007 at 12:38:20PM +0530, it looks like Suresh Kumar J sent me:Just to clarify, I have used '41' and '80' just as an example. My question was on the syntax of the 'itype' and 'icode' constructs... On 4/4/07, Suresh Kumar J <suresh.kumar.j () gmail com> wrote:Hi! I have a question on the format of the 'icode' and 'itype' options since it seems to cause confusion. Below is the format of the 'itype' and 'icode' options as defined in v2.6.x: itype: [<|>]<number>[<><number>]; icode: [<|>]<number>[<><number>]; With this format, I know that the following options are valid: (itype:<41;) (itype:>80;) (itype:41<>80;) I wanted to know whether or not the following options are valid and really make sense: (itype:>41<80) (itype:>41<>80) (itype:<41<>80) (itype:>41>80) (itype:<41<80) Appreciate your inputs. -- Thanks and Regards, Suresh Kumar J-- Thanks and Regards, Suresh Kumar J ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users+---------------------------------------------------------------------+ Joel Esler Security Consultant gpg key: http://demo.sourcefire.com/jesler.pgp.key +---------------------------------------------------------------------+-- Thanks and Regards, Suresh Kumar J ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Query on the format of 'icode' and 'itype' options Suresh Kumar J (Apr 03)
- Re: Query on the format of 'icode' and 'itype' options Suresh Kumar J (Apr 04)
- Re: Query on the format of 'icode' and 'itype' options Joel Esler (Apr 04)
- Re: Query on the format of 'icode' and 'itype' options Suresh Kumar J (Apr 04)
- Re: Query on the format of 'icode' and 'itype' options Justin Heath (Apr 04)
- Message not available
- Message not available
- Re: Query on the format of 'icode' and 'itype' options Justin Heath (Apr 04)
- Re: Query on the format of 'icode' and 'itype' options Joel Esler (Apr 04)
- Re: Query on the format of 'icode' and 'itype' options Suresh Kumar J (Apr 04)