Re: -S and ipvar vs. var

[Duane Howard <duane.security () gmail com>]

Thanks Joel,

I'm aware of -S, my real question is around whether -S is (internally)
treated like 'var' or 'ipvar', and if it's 'var' is there a notable
downside to using 'var' vs. 'ipvar' in this context?

./d


On Tue, Jul 22, 2014 at 2:57 PM, Joel Esler (jesler) <jesler () cisco com>
wrote:

>  Wrote about this a long time ago on my personal blog:
>
>  http://blog.joelesler.net/2010/03/how-to-specify-snort-variable-from.html
>
>  --
> *Joel Esler*
> Open Source Manager
> Threat Intelligence Team Lead
> Vulnerability Research Team
>
>  On Jul 22, 2014, at 3:07 PM, Duane Howard <duane.security () gmail com>
> wrote:
>
>  My reading of the -h description is that it's not equivalent to defining
> HOME_NET:
> -h home-net
>               Set  the  "home  network" to home-net.  The format of this
> address variable is a network prefix plus a CIDR block, such as
> 192.168.1.0/24.  Once this variable is set, all decoded packet logging
>               will be done relative to the home network address space.
>  This is useful because of the way that Snort formats its ASCII log data.
>  With this value set to the local network, all decoded  output
>               will  be  logged into decode directories with the address of
> the foreign computer as the directory name, which is very useful during
> traffic analysis. *This option does not change "$HOME_NET" in*
> *              IDS mode.*
>
>  I would like to define (and currently do) HOME_NET as an ipvar, but I'm
> not sure how to do so from the command line if that's at all possible...
>
>  ./d
>
>
> On Tue, Jul 22, 2014 at 11:27 AM, Steve Gantz <
> stephen.gantz () faculty umuc edu> wrote:
>
> >  Current Snort manual says all IP variables are to be specified with
> > ipvar, so I would expect that would include HOME_NET. I think you want to
> > be using -h as the command line option to pass the value of HOME_NET.
> >
> >
> >  Dr. Stephen D. Gantz, CISSP-ISSAP, CEH, CGEIT, CRISC, CIPP/G, C|CISO
> >
> > Professor of Information Assurance
> >
> > The Graduate School
> >
> > University of Maryland University College
> >
> > stephen.gantz () faculty umuc edu
> >
> >
> > On Jul 22, 2014, at 1:30 PM, Duane Howard <duane.security () gmail com>
> > wrote:
> >
> >  Hey folks,
> >
> >  I've got a need to move HOME_NET to being passed on the command line
> > using -S HOME_NET="blah" and I'm wondering if this will internally be
> > treated as a 'var' or 'ipvar' and whether it matters at all. Is there a
> > mechanism to say -S 'ipvar HOME_NET'='blah'?
> >
> >  ./d
> >
> >
> > ------------------------------------------------------------------------------
> > Want fast and easy access to all the code in your enterprise? Index and
> > search up to 200,000 lines of code with a free copy of Black Duck
> > Code Sight - the same software that powers the world's largest code
> > search on Ohloh, the Black Duck Open Hub! Try it now.
> > http://p.sf.net/sfu/bds
> >
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> >
> > Please visit http://blog.snort.org to stay current on all the latest
> > Snort news!
>
> ------------------------------------------------------------------------------
> Want fast and easy access to all the code in your enterprise? Index and
> search up to 200,000 lines of code with a free copy of Black Duck
> Code Sight - the same software that powers the world's largest code
> search on Ohloh, the Black Duck Open Hub! Try it now.
> http://p.sf.net/sfu/bds_______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
------------------------------------------------------------------------------
Want fast and easy access to all the code in your enterprise? Index and
search up to 200,000 lines of code with a free copy of Black Duck
Code Sight - the same software that powers the world's largest code
search on Ohloh, the Black Duck Open Hub! Try it now.
http://p.sf.net/sfu/bds

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!