[Snort-users] Question about negated and non-negated variables in rules
mkettler at ...4108...
Fri Nov 28 11:12:06 EST 2003
At 08:49 AM 11/27/2003, J-H. Johansen wrote:
>I'm working on some ICMP rules and was wondering
>Recently I added a variable which contains our homenet with exclusions:
>var NOT_ICMP_SERVERS [$HOME_NET,!xxx.xxx.xx.xxx/32,!xxx.xx.xx.xx/32]
>This failed while running a check so I've also tried:
>Any clues as to how this must be done ?
All of the above rules are logically equivalent to "any".
what you really want is:
var NOT_ICMP_SERVERS ![$HOME_NET,xxx.xxx.xx.xxx/32,xxx.xx.xx.xx/32]
ie: Not (a or b or c) instead of (not a) or (not b) or (not c).
Work through the boolean math... c matches (not a) as well as (not b). Thus
everything, including a, b and c, will match the second version.
More information about the Snort-users