[Snort-sigs] all but one port option?

SRH-Lists giermo at ...1992...
Mon Feb 9 13:45:03 EST 2004

> The answer is probably no, but I will ask anyway.
> Is it possible to write a rule that listens in on all but one port? 
> Say I wanted to listen to all TCP except port 80.
> Thanks,
> Keith

The answer is yes.


alert tcp $EXTERNAL_NET any -> $HOME_NET !80 (blah balh blah blah)


More information about the Snort-sigs mailing list