[Snort-users] IP Address's in Rule

Mike McCabe mike at ...6998...
Wed Oct 9 09:58:05 EDT 2002


How do I include specific IP addresses in a rule.  Say I want to have
certain IP addresses not looked at and still want the rule to use
EXTERNAL_NET...  Something like:

alert tcp [!X.Y.W.Z/32,!A.B.C.D/32,!E.F.G.H/32,$EXTERNAL_NET] any ->
$HOME_NET 53 (msg:"DNS zone transfer"; content: "|00 00 FC|"; flags: A+;
offset: 13; reference:arachnids,212; classtype:attempted-recon; sid:255;
rev:2;)

But it doesn't seem to work...

Any help would be appreciated...

Mike





More information about the Snort-users mailing list