[Snort-users] Ignoring arbitrary ports for certain rules

Matt Kettler mkettler at ...4108...
Thu May 20 09:57:02 EDT 2004

At 06:36 AM 5/20/2004, AJ Butcher, Information Systems and Computing wrote:
>var P2P_PORTS [5541,6346:6352,6881:6884]
>and then use something like:
>alert tcp any !P2P_PORTS <> $HOME_NET !P2P_PORTS ...
>I can't seem to find any syntax (spaces, commas, square brackets) to allow 
>this, and in fact, I suspect it isn't possible. Can anyone confirm or deny 

I can confirm it's not possible. IP addresses can have comma-delimited 
discontinuous lists, but ports cannot.

You can do a port, a range or a negation of either a port or a range, but 
that's it.

The legal syntax is documented in section 2.2.4 of the manual:

More information about the Snort-users mailing list