[Snort-users] variable problem

Matt Kettler mkettler at ...4108...
Tue Jun 17 09:04:09 EDT 2003


At 12:52 PM 6/16/2003 -0400, Erek Adams wrote:
> >       HOME_NET 10.6.0.0/24
> >       EXTERNAL_NET [!10.6.0.0/24,!10.5.0.0/24]
>
>That's set correctly.

*buys Erek some coffee*

It looks like someone else pointed it out but that is most certainly NOT 
correct.

EXTERNAL_NET [!10.6.0.0/24,!10.5.0.0/24]

is logically the same as

EXTERNAL_NET any

As someone else stated, the correct form is:
EXTERNAL_NET ![10.6.0.0/24,10.5.0.0/24]






More information about the Snort-users mailing list