[Snort-users] Question about negated and non-negated variables in rules

Matt Kettler mkettler at ...4108...
Fri Nov 28 11:12:06 EST 2003

At 08:49 AM 11/27/2003, J-H. Johansen wrote:
>I'm working on some ICMP rules and was wondering
>Recently I added a variable which contains our homenet with exclusions:
>var NOT_ICMP_SERVERS [$HOME_NET,!xxx.xxx.xx.xxx/32,!xxx.xx.xx.xx/32]
>This failed while running a check so I've also tried:
>Any clues as to how this must be done ?

All of the above rules are logically equivalent to "any".

what you really want is:

var NOT_ICMP_SERVERS ![$HOME_NET,xxx.xxx.xx.xxx/32,xxx.xx.xx.xx/32]

ie: Not (a or b or c) instead of (not a) or (not b) or (not c).

Work through the boolean math... c matches (not a) as well as (not b). Thus 
everything, including a, b and c, will match the second version.

More information about the Snort-users mailing list