[Snort-users] Question about negated and non-negated variables in rules

Jens-Harald Johansen corinth at ...4741...
Fri Nov 28 11:50:03 EST 2003


Matt Kettler wrote:

> At 08:49 AM 11/27/2003, J-H. Johansen wrote:
>
>> I'm working on some ICMP rules and was wondering
>> Recently I added a variable which contains our homenet with exclusions:
>>
>> var NOT_ICMP_SERVERS [$HOME_NET,!xxx.xxx.xx.xxx/32,!xxx.xx.xx.xx/32]
>>
>> This failed while running a check so I've also tried:
>>
>>
>> Any clues as to how this must be done ?
>
>
>
> All of the above rules are logically equivalent to "any".
>
> what you really want is:
>
> var NOT_ICMP_SERVERS ![$HOME_NET,xxx.xxx.xx.xxx/32,xxx.xx.xx.xx/32]
>
>
> ie: Not (a or b or c) instead of (not a) or (not b) or (not c).
>
>
> Work through the boolean math... c matches (not a) as well as (not b). 
> Thus everything, including a, b and c, will match the second version.
>
>
>
Thanks Matt, but what I was looking for was the boolean equivalent of:

(a) and ((not b) or (not c))

Meaning, I want a, but not b or c. This rule will then be negated in the 
rules I'm mod'ing.

jens:H






More information about the Snort-users mailing list