[Snort-users] What is the best way to enable different rules for different subnets in Snort?

Al Lewis (allewi) allewi at ...589...
Mon Aug 10 07:30:50 EDT 2015


See the section in the manual on rules:

http://manual.snort.org/node29.html#SECTION00423000000000000000


Albert Lewis
QA Software Engineer
SOURCEfire, Inc. now part of Cisco
9780 Patuxent Woods Drive
Columbia, MD 21046
Phone: (office) 443.430.7112
Email: allewi at ...589...

From: Alptugay Değrimencioğlu [mailto:alptugay at ...17278...]
Sent: Monday, August 10, 2015 6:05 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] What is the best way to enable different rules for different subnets in Snort?


We have snort running on one of our servers which has a network interface that has a subnet configuration of 192.168.0.0/16 I want to enable a specific rule, for example a chat rule with the sid:2002027, to 192.168.1.0/24 but I don't want the rule be active for 192.168.2.0/24. What is the best way to achieve this?

alert tcp any 6666:7000 -> any any (msg:"ET CHAT IRC PING command"; flow:from_server,established; content:"PING|20|"; depth:5; flowbits:set,is_proto_irc; reference:url,doc.emergingthreats.net/2002027; classtype:misc-activity; sid:2002027; rev:13;)

And also, the any keyword like the one in the above rule should be limited to 192.168.1.0/24. Otherwise it would affect 192.168.2.0/24. And I am trying to automate this because we can have many subnets and many different rules for these subnets.

Any advice would be great
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150810/75f50df8/attachment.html>


More information about the Snort-users mailing list