[Snort-users] Assistance with Blacklist

waldo kitty wkitty42 at ...14940...
Tue Apr 9 12:44:41 EDT 2013


On 4/9/2013 10:30, Hannibal S. Jackson wrote:
> I'm getting ERROR: c:\snort\rules\black_list.rules (4) Invalid configuration
> line: 31.13.69.160
>
> The only thing I have in my black_list.rules file is this:
>
> # This is my black_list.rules file for www.facebook.com
> 31.13.69.160/0

this is not a valid network address or CIDR mask... the address is a 
workstation/server address, though... you need to use a proper network address 
and CIDR mask...

in this case, the facebook network range is 31.13.64.0 - 31.13.127.255 so the 
proper mask would be 31.13.64.0/18


IP Address        : 31.13.64.0
Address Class     : Classless /18
Network Address   : 31.13.64.0

Subnet Address    : 31.13.64.0
Subnet Mask       : 255.255.192.0
Subnet bit mask   : nnnnnnnn.nnnnnnnn.nnhhhhhh.hhhhhhhh
Subnet Bits       : 18
Host Bits         : 14
Number of Subnets : 1
Hosts per Subnet  : 16382

Subnet            : 31.13.64.0
Mask              : 255.255.192.0
Subnet Size       : 16382 Hosts
Host Range        : 31.13.64.1  to  31.13.127.254
Broadcast         : 31.13.127.255





More information about the Snort-users mailing list