[Snort-users] var or ipvar?

waldo kitty wkitty42 at ...14940...
Mon Jan 28 15:36:41 EST 2013


On 1/28/2013 15:10, Joel Esler wrote:
> Ipvar, for ips. Portvar for ports.

i love bikini answers! short and to the point ;)

but in this case, i'm needing a bit more information, please...

ipvar was started being used for IPv6 at what version of snort?

ipvar was started being used for both IPv4 and IPv6 at what version of snort?

var was no longer for IPv4 used at what version of snort?

and lastly this question from the previous post...

will older snorts fall over because of ipvar being introduced into their 
environment before they are ready for it?

thank you...


>
> --
> Joel Esler
> Sent from my iPad
>
> On Jan 28, 2013, at 3:01 PM, Nicholas Bogart <nickybzoss at ...11827...
> <mailto:nickybzoss at ...11827...>> wrote:
>
>> Last I remember on this from the manual you only use ipvar if you are working
>> in an IPv6 evironment and have enabled snort for IPv6. If you have it turned
>> off then you can continue and are encouraged to still use var.
>> Nick
>>
>> On Mon, Jan 28, 2013 at 1:56 PM, waldo kitty <wkitty42 at ...14940...
>> <mailto:wkitty42 at ...14940...>> wrote:
>>
>>
>>     var used to be used for most all var definitions... then work was being
>>     done for
>>     IPv6 and ipvar was created... since then, it seems that ipvar has been
>>     retained
>>     for all and var is simply no longer used...
>>
>>     is this accurate?
>>
>>     why is var not retained as an alias for ipvar? systems have been breaking all
>>     around us and it is only just now that we're starting to find this possibly
>>     being the problem :(
>>
>>     will it hurt to have both var and ipvar pointing to the same definitions??
>>
>>     will older snorts fall over because of ipvar being introduced into their
>>     environment before they are ready for it?






More information about the Snort-users mailing list