[Snort-users] Setting Up Policy-Based.rules file

Kaplan, Andrew H. AHKAPLAN at ...10063...
Mon Nov 3 08:03:19 EST 2003

Hi there,

I am setting up a policy-based rules file to have Snort monitor traffic
coming from the Internet, while allowing
network traffic from the internal network to pass without incident. I want
to provide a blanket pass statement
for the internal network, and I want to verify several things:

1. I don't want, initally, to monitor any traffic going from the
network to any TCP/IP port on the server Therefore would the following statements work?

		pass ip any -> 0:65534
		pass tcp any -> 0:65534
		pass udp any -> 0:65534

2. If I want, at a later date, to monitor particular port traffic, do I add
the ports I want to monitor AFTER the 
    blanket range shown in item 1, or do I add them BEFORE it?


More information about the Snort-users mailing list