[Snort-users] IP Address's in Rule
mike at ...6998...
Wed Oct 9 09:58:05 EDT 2002
How do I include specific IP addresses in a rule. Say I want to have
certain IP addresses not looked at and still want the rule to use
EXTERNAL_NET... Something like:
alert tcp [!X.Y.W.Z/32,!A.B.C.D/32,!E.F.G.H/32,$EXTERNAL_NET] any ->
$HOME_NET 53 (msg:"DNS zone transfer"; content: "|00 00 FC|"; flags: A+;
offset: 13; reference:arachnids,212; classtype:attempted-recon; sid:255;
But it doesn't seem to work...
Any help would be appreciated...
More information about the Snort-users