[Snort-users] What is the best way to enable different rules for different subnets in Snort?

Alptugay Değrimencioğlu alptugay at ...17278...
Mon Aug 10 06:04:33 EDT 2015


We have snort running on one of our servers which has a network 
interface that has a subnet configuration of |192.168.0.0/16| I want to 
enable a specific rule, for example a chat rule with the sid:2002027, to 
|192.168.1.0/24| but I don't want the rule be active for 
|192.168.2.0/24|. What is the best way to achieve this?

|alert tcp any 6666:7000 -> any any (msg:"ET CHAT IRC PING command"; flow:from_server,established; content:"PING|20|"; depth:5; flowbits:set,is_proto_irc; reference:url,doc.emergingthreats.net/2002027; classtype:misc-activity; sid:2002027; rev:13;)
|

And also, the any keyword like the one in the above rule should be 
limited to |192.168.1.0/24|. Otherwise it would affect |192.168.2.0/24|. 
And I am trying to automate this because we can have many subnets and 
many different rules for these subnets.

Any advice would be great

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150810/6ff0caad/attachment.html>


More information about the Snort-users mailing list