Snort mailing list archives
Re: Query on the format of 'icode' and 'itype' options
From: "Justin Heath" <justin.heath () gmail com>
Date: Wed, 4 Apr 2007 11:25:57 -0400
No problem. I have added a bug to our queue to print out a waring on invalid usage of this option. Once again the syntax itype:> x > y will be evaluated as itype:> x. Cheers, Justin Heath On 4/4/07, Suresh Kumar J <suresh.kumar.j () gmail com> wrote:
Hi Justin, Thanks for your reply! I was expecting that Snort2.6 would throw some error message stating the syntax is not meaningful. How about the following constructs: itype:> x > y itype:< x < y All these confusions arises because of the ambiguous syntax of the 'itype' and 'icode' options. --Suresh On 4/4/07, Justin Heath <justin.heath () gmail com> wrote:Suresh, This syntax is technically invalid. The range portion of your construct is going to be ignored using this syntax. For example, itype:> x <> y will be evaluated as itype:> x. Thanks, Justin Heath On 4/4/07, Suresh Kumar J <suresh.kumar.j () gmail com> wrote:I wanted to hear from the Snort developers/experts about the validity of the following usages of 'itype' and 'icode' constructs. These options are accepted by the Snort 2.6 tool, but am not sure if they make any sense: itype:> x <> y itype:< x <> y itype:> x > y itype:< x < y --Suresh On 4/4/07, Joel Esler <joel.esler () sourcefire com> wrote:When in doubt, test it out! On Wed, Apr 04, 2007 at 12:38:20PM +0530, it looks like Suresh Kumar J sent me:Just to clarify, I have used '41' and '80' just as an example. My question was on the syntax of the 'itype' and 'icode' constructs... On 4/4/07, Suresh Kumar J <suresh.kumar.j () gmail com> wrote:Hi! I have a question on the format of the 'icode' and 'itype' options since it seems to cause confusion. Below is the format of the 'itype' and 'icode' options as defined in v2.6.x: itype: [<|>]<number>[<><number>]; icode: [<|>]<number>[<><number>]; With this format, I know that the following options are valid: (itype:<41;) (itype:>80;) (itype:41<>80;) I wanted to know whether or not the following options are valid and really make sense: (itype:>41<80) (itype:>41<>80) (itype:<41<>80) (itype:>41>80) (itype:<41<80) Appreciate your inputs. -- Thanks and Regards, Suresh Kumar J-- Thanks and Regards, Suresh Kumar J ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users+---------------------------------------------------------------------+ Joel Esler Security Consultant gpg key: http://demo.sourcefire.com/jesler.pgp.key +---------------------------------------------------------------------+-- Thanks and Regards, Suresh Kumar J ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users-- Thanks and Regards, Suresh Kumar J
------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Query on the format of 'icode' and 'itype' options Suresh Kumar J (Apr 03)
- Re: Query on the format of 'icode' and 'itype' options Suresh Kumar J (Apr 04)
- Re: Query on the format of 'icode' and 'itype' options Joel Esler (Apr 04)
- Re: Query on the format of 'icode' and 'itype' options Suresh Kumar J (Apr 04)
- Re: Query on the format of 'icode' and 'itype' options Justin Heath (Apr 04)
- Message not available
- Message not available
- Re: Query on the format of 'icode' and 'itype' options Justin Heath (Apr 04)
- Re: Query on the format of 'icode' and 'itype' options Joel Esler (Apr 04)
- Re: Query on the format of 'icode' and 'itype' options Suresh Kumar J (Apr 04)