[Snort-users] var or ipvar?

waldo kitty wkitty42 at ...14940...
Mon Jan 28 15:40:22 EST 2013


On 1/28/2013 15:01, Nicholas Bogart wrote:
> Last I remember on this from the manual you only use ipvar if you are working in
> an IPv6 evironment and have enabled snort for IPv6.  If you have it turned off
> then you can continue and are encouraged to still use var.

thanks... that's been my understanding but reality doesn't seem to be following 
along :?

then there's that what we work with has some IPv6 work being done in it, it is 
not ready by a long shot... what does snort use to determine the existance of 
IPv6 and if it is workable? we have folks working on trying to ensure that IPv6 
is not transitioning our devices since that is a mechanism for hiding traffic :?

this snakepit is filling up with more and more snakes faster than we can throw 
the existing ones out...

> Nick
>
> On Mon, Jan 28, 2013 at 1:56 PM, waldo kitty <wkitty42 at ...14940...
> <mailto:wkitty42 at ...14940...>> wrote:
>
>
>     var used to be used for most all var definitions... then work was being done for
>     IPv6 and ipvar was created... since then, it seems that ipvar has been retained
>     for all and var is simply no longer used...
>
>     is this accurate?
>
>     why is var not retained as an alias for ipvar? systems have been breaking all
>     around us and it is only just now that we're starting to find this possibly
>     being the problem :(
>
>     will it hurt to have both var and ipvar pointing to the same definitions??
>
>     will older snorts fall over because of ipvar being introduced into their
>     environment before they are ready for it?






More information about the Snort-users mailing list