[Snort-users] Ignoring arbitrary ports for certain rules
AJ Butcher, Information Systems and Computing
Alex.Butcher at ...11254...
Fri May 21 00:41:01 EDT 2004
--On 20 May 2004 12:56 -0400 Matt Kettler <mkettler at ...4108...> wrote:
> At 06:36 AM 5/20/2004, AJ Butcher, Information Systems and Computing
>> var P2P_PORTS [5541,6346:6352,6881:6884]
>> and then use something like:
>> alert tcp any !P2P_PORTS <> $HOME_NET !P2P_PORTS ...
>> I can't seem to find any syntax (spaces, commas, square brackets) to
>> allow this, and in fact, I suspect it isn't possible. Can anyone
>> confirm or deny this?
> I can confirm it's not possible. IP addresses can have comma-delimited
> discontinuous lists, but ports cannot.
> You can do a port, a range or a negation of either a port or a range, but
> that's it.
> The legal syntax is documented in section 2.2.4 of the manual:
That's what I was thinking. Thanks for the confirmation.
Does anyone have smarter strategies than:
a) using a BPF filter to "blind" the IDS to traffic involving one or more
well-known P2P port.
b) creating a number of "pass" rules for each affected rule.
Alex Butcher: Security & Integrity, Personal Computer Systems Group
Information Systems and Computing GPG Key ID: F9B27DC9
GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9
More information about the Snort-users