[Snort-users] What is the difference in using IPVAR and VAR ?

Michael Steele michaels at ...9077...
Wed Aug 17 22:57:53 EDT 2011

I need some clarification on the usage of ipvar and var

The stock snort.conf  that comes with the rules has 'ipvar' set as the

If I have ipv6 and ipv4 activated would I use ipvar and not var in the
snort.conf?- Snort would be IPV6 compiled

If I only have ipv4 activated,  would I use var in the snort.conf, or does
it matter if I use ipvar? - Snort would not be IPV6 compiled

Kindest regards,

More information about the Snort-users mailing list