[Snort-devel] Variables don't need dollar sign in sig?
mike.cox52 at ...2499...
Thu Nov 13 11:21:56 EST 2014
I recently realized that I had some rules that used an ipvar but without
the dollar sign. For example:
alert HOME_NET any -> ...
alert $HOME_NET any -> ...
The strange thing is, this seems to work fine and the rule alerts as
expected. However, I couldn't find anything in the manual about this
behavior. Is this normal?
In my case I do have this in my conf:
ipvar HOME_NET any
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-devel