[Snort-users] -S and ipvar vs. var

Joel Esler (jesler) jesler at ...589...
Tue Jul 22 18:58:23 EDT 2014


Well, in recent versions of Snort, there is no such thing as “Var” for an IP or port variable.  just portvar and ipvar



On Jul 22, 2014, at 6:19 PM, Duane Howard <duane.security at ...11827...<mailto:duane.security at ...11827...>> wrote:

Thanks Joel,

I'm aware of -S, my real question is around whether -S is (internally) treated like 'var' or 'ipvar', and if it's 'var' is there a notable downside to using 'var' vs. 'ipvar' in this context?

./d


On Tue, Jul 22, 2014 at 2:57 PM, Joel Esler (jesler) <jesler at ...589...<mailto:jesler at ...589...>> wrote:
Wrote about this a long time ago on my personal blog:

http://blog.joelesler.net/2010/03/how-to-specify-snort-variable-from.html

--
Joel Esler
Open Source Manager
Threat Intelligence Team Lead
Vulnerability Research Team

On Jul 22, 2014, at 3:07 PM, Duane Howard <duane.security at ...11827...<mailto:duane.security at ...11827...>> wrote:

My reading of the -h description is that it's not equivalent to defining HOME_NET:
-h home-net
              Set  the  "home  network" to home-net.  The format of this address variable is a network prefix plus a CIDR block, such as 192.168.1.0/24<http://192.168.1.0/24>.  Once this variable is set, all decoded packet logging
              will be done relative to the home network address space.  This is useful because of the way that Snort formats its ASCII log data.  With this value set to the local network, all decoded  output
              will  be  logged into decode directories with the address of the foreign computer as the directory name, which is very useful during traffic analysis. This option does not change "$HOME_NET" in
              IDS mode.

I would like to define (and currently do) HOME_NET as an ipvar, but I'm not sure how to do so from the command line if that's at all possible...

./d


On Tue, Jul 22, 2014 at 11:27 AM, Steve Gantz <stephen.gantz at ...16854...<mailto:stephen.gantz at ...16854...>> wrote:
Current Snort manual says all IP variables are to be specified with ipvar, so I would expect that would include HOME_NET. I think you want to be using -h as the command line option to pass the value of HOME_NET.


Dr. Stephen D. Gantz, CISSP-ISSAP, CEH, CGEIT, CRISC, CIPP/G, C|CISO
Professor of Information Assurance
The Graduate School
University of Maryland University College
stephen.gantz at ...16854...<mailto:stephen.gantz at ...16854...>


On Jul 22, 2014, at 1:30 PM, Duane Howard <duane.security at ...11827...<mailto:duane.security at ...11827...>> wrote:

Hey folks,

I've got a need to move HOME_NET to being passed on the command line using -S HOME_NET="blah" and I'm wondering if this will internally be treated as a 'var' or 'ipvar' and whether it matters at all. Is there a mechanism to say -S 'ipvar HOME_NET'='blah'?

./d
------------------------------------------------------------------------------
Want fast and easy access to all the code in your enterprise? Index and
search up to 200,000 lines of code with a free copy of Black Duck
Code Sight - the same software that powers the world's largest code
search on Ohloh, the Black Duck Open Hub! Try it now.
http://p.sf.net/sfu/bds
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net<mailto:Snort-users at lists.sourceforge.net>
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org<http://blog.snort.org/> to stay current on all the latest Snort news!

------------------------------------------------------------------------------
Want fast and easy access to all the code in your enterprise? Index and
search up to 200,000 lines of code with a free copy of Black Duck
Code Sight - the same software that powers the world's largest code
search on Ohloh, the Black Duck Open Hub! Try it now.
http://p.sf.net/sfu/bds_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net<mailto:Snort-users at lists.sourceforge.net>
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org<http://blog.snort.org/> to stay current on all the latest Snort news!



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20140722/b27c6101/attachment.html>


More information about the Snort-users mailing list