[Snort-users] Multiple HOME_NET IP's

Daniel van Balen vdaniel at ...191...
Sat Aug 12 01:59:21 EDT 2000


On Fri, Aug 11, 2000 at 09:34:16PM -0700, Dragos Ruiu wrote:
> As far as the rules syntax, you could make addresses including a comma
> and no whitespace, complex-multi-part-addresses. I.e.
> 
> 10.1.1.0/24
> 
> and
> 
> 10.2.2.0/24,10.1.1.0/24,192.168.0.0/16
> 
> Opinions?
> 

	I'm all for it... but would you be able make a element of the list the
negation of a adress?

10.1.1.0/24,!10.1.1.45


-spiff

-spiff




More information about the Snort-users mailing list