[Snort-users] Question on port lists and negation

Jason security at ...5028...
Tue Oct 9 23:06:30 EDT 2007


> 
> Your large table of operations confuses me greatly, but it may be
> because I don't understand your syntax.
> 
>> (80 == !(80 || 80))     :       0
>> !(80 == (80 || 80))     :       1
> 
> What are those two supposed to represent, logically speaking, and how do
> they differ?
> 
> From my C-code centered view I read (80 == !(80 || 80)) as:
> 
> (80 "is equal to" not ( 80 BOOLEAN OR 80))
> 
> Which is nonsense. You don't boolean OR together two integers. You can,
> but it's pointless nonsense.
> 
> using [80,81] in for a dport rule would be read as:
> 
> match if dport is equal to 80 or dport is equal to 81.
> 
> Which I would express as:
> 
> (dport == 80 || dport == 81)
> 

The intent of the table was to show the various operations, simple as
that. While much of it does not make sense it was sufficient to
illustrate the point while keeping it contextual, at lest I thought. I
missed the mark on that one. Here is a verbose version of what I
intended to get across.

I attached the redone code too. I included every method (well most),
including the ones that do not make logical sense. It's not uncommon for
a type to cause an | instead of an || or to use an & instead of an | etc...

For a of 80, b of 80, t of 80
========================================
(a|b)                           : 80
(a||b)                          : 1
!(a|b)                          : 0
!(a||b)                         : 0
(!a|!b)                         : 0
(!a||!b)                        : 0
(a|b)                           : 80
t == (a|b)                      : 1
t == !(a|b)                     : 0
(t == a || t == b)              : 1
!(t == a || t == b)             : 0
(!(t == a) || !(t == b))        : 0
(t == a && t == b)              : 1
!(t == a && t == b)             : 0
(!(t == a) && !(t == b))        : 0



For a of 80, b of 81, t of 80
========================================
(a|b)                           : 81
(a||b)                          : 1
!(a|b)                          : 0
!(a||b)                         : 0
(!a|!b)                         : 0
(!a||!b)                        : 0
(a|b)                           : 81
t == (a|b)                      : 0
t == !(a|b)                     : 0
(t == a || t == b)              : 1
!(t == a || t == b)             : 0
(!(t == a) || !(t == b))        : 1
(t == a && t == b)              : 0
!(t == a && t == b)             : 1
(!(t == a) && !(t == b))        : 0



For a of 80, b of 81, t of 8000
========================================
(a|b)                           : 81
(a||b)                          : 1
!(a|b)                          : 0
!(a||b)                         : 0
(!a|!b)                         : 0
(!a||!b)                        : 0
(a|b)                           : 81
t == (a|b)                      : 0
t == !(a|b)                     : 0
(t == a || t == b)              : 0
!(t == a || t == b)             : 1
(!(t == a) || !(t == b))        : 1
(t == a && t == b)              : 0
!(t == a && t == b)             : 1
(!(t == a) && !(t == b))        : 1


I'll be sure to spend more time on writing replies to there topics.
And... I've still not had time to look at the code to see what it is
really doing, now I'm just too curious. I'll try to get to that
tomorrow. My gut tells me it is in the negation of lists but you and the
other Matt have different opinions. Testing and/or code are the only
true ways to provide the real answer.

-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: or.c
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20071009/f8d63891/attachment.c>


More information about the Snort-users mailing list