[Snort-sigs] help needed on var definitions for a rule

Ed.Davison at ...472... Ed.Davison at ...472...
Wed Mar 27 21:31:07 EST 2002


> >
> > var DNS_SERVERS [146.6.50.200/32,128.83.62.200/32,146.6.167.220/32]
> > var DNS 146.6.50.200/32,128.83.62.200/32,146.6.167.220/32
> >
> > var DNS_INT [$DNS,$HOME_NET1,$HOME_NET2]
> > var DNS_EXT [$DNS,$EXTERNAL_NET]
> >
> 
> Well, first thing that I would check is the define of DNS.  
> Since you're not
> using []'s around it, it might be having some troubles with 
> that.  Check that
> and see what happens.
> 

Well, I had thought about that as well but if you look at the above var
definitions, you will see why there are no []'s around DNS.

DNS is defined without the []'s as it is included in a var that has
[]'s, namely DNS_INT, and if I were to put the []'s in it would evaluate
to:

[[xxx.xxx.xxx.xxx/32,xxx.xxx.xxx.xxx/32],xxx.xxx.xxx.xxx/24]

and I thought embedded []'s was illegal.

Ed
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20020327/f40b3198/attachment.html>


More information about the Snort-sigs mailing list