[Snort-sigs] Rule with two ports

Suzanne.VanPatten at ...394... Suzanne.VanPatten at ...394...
Fri Mar 1 08:49:14 EST 2002


I'm trying to write a snort rule that allows me to alert on all traffic of a
type that is not to two distinct ports...tried !porta!portb and all
combinations I could think of (including creating a variable, i.e. PORTTEST
[1,3]. Is there a way to do this??

Suzanne B. VanPatten





More information about the Snort-sigs mailing list