mkettler at ...4108...
Wed Feb 11 12:29:02 EST 2004
At 12:21 PM 2/11/2004, SN ORT wrote:
>Would it be possible to make the documents with more
Possible, yes... are there any volunteers who have the spare time available
to do so?
(remember, this is open source.. the best way to get things done is to do
As for an example of how to use HTTP_INSPECT, why don't you just look in
the stock snort.conf? There's an example right there.
>I used the config options, trying to figure out if
>these all go on the same line or different, trying to
>figure out by trial and error if I can use a variable
>for the "servers" IP address, such as $HTTP_SERVERS!!
Of course you can use a variable... snort.conf "variables" aren't really
variables at all.. they are text substitution macros. You can use/abuse
them for almost anything. (If you're a C programmer, think of var as if it
Heck, you could make an entire rule into a "variable" if you wanted to.
# theoretically, this is legal.
var $ALERT_ON_EVERYTHING alert ip any any -> any any (msg:"blah";)
>(so now how do I specify more than one?),
The same way you do everywhere else.. AFAIK all of snort accepts the same
IP address format. CIDR masks, and bracketed comma delimited lists.
There's nothing magic about "variables"... you can use bracketed lists
anywhere in snort where you specify an IP address.
>for myself I have to use the "\" to specify more
>options, and then find out there has to be a space
>between the last character and the "\", and then
>finally find out that I can't even use all of the
>options per the error below.
If you'd have looked at the example that is already in snort 2.1's
snort.conf you'd have known about the \ thing.
Technically, the \ is used to cause more than one line to be treated as a
single line.. basic unix 101.
Thus, you don't need a \ per option, you need it if you go to a new line..
again look at snort.conf
More information about the Snort-users