[Snort-users] EXTERNAL_NET

Don Don at ...5881...
Sun Jun 23 00:42:02 EDT 2002


that would be 
var HOME_NET [A.B.0.0/16]*
var EXTERNAL_NET !$HOME_NET
u cant forget the $ to identify it is using a variable that has been set


> >-----Original Message-----
> >From: snort-users-admin at lists.sourceforge.net
> >[mailto:snort-users-admin at lists.sourceforge.net]On Behalf Of Phil Wood
> >Sent: Saturday, June 22, 2002 11:11 PM
> >To: snort-users at lists.sourceforge.net
> >Subject: Re: [Snort-users] EXTERNAL_NET
> >
> >
> >On Sun, Jun 23, 2002 at 01:32:40AM -0400, Ashley Thomas wrote:
> >> Is it correct to say 
> >> var EXTERNAL_NET !A.B.0.0/8
> >> 
> >> if i need to consider every ip except A.B.0.0 range as external ?
> >
> >  var HOME_NET [A.B.0.0/16]*
> >
> >  var EXTERNAL_NET !HOME_NET 
> >
> >The brackets allow for some more nets like:
> >
> >  var HOME_NET [A.B.0.0/16,192.168.1.0/24]
> >
> >> 
> >> thanks 
> >> ashley
> >> 
> >> 
> >> -------------------------------------------------------
> >> Sponsored by:
> >> ThinkGeek at http://www.ThinkGeek.com/
> >> _______________________________________________
> >> Snort-users mailing list
> >> Snort-users at lists.sourceforge.net
> >> Go to this URL to change user options or unsubscribe:
> >> https://lists.sourceforge.net/lists/listinfo/snort-users
> >> Snort-users list archive:
> >> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> >
> >-- 
> >Phil Wood, cpw at ...440...
> >
> >
> >
> >-------------------------------------------------------
> >Sponsored by:
> >ThinkGeek at http://www.ThinkGeek.com/
> >_______________________________________________
> >Snort-users mailing list
> >Snort-users at lists.sourceforge.net
> >Go to this URL to change user options or unsubscribe:
> >https://lists.sourceforge.net/lists/listinfo/snort-users
> >Snort-users list archive:
> >http://www.geocrawler.com/redir-sf.php3?list=snort-users
> >




More information about the Snort-users mailing list