Re: RE: [Snort-sigs] ports

[Jason <security () brvenik com>]

IIRC this is the the FAQ or the manual

var SPECIFIC_PORT 21
include port_list.rules

var SPECIFIC_PORT 110
include port_list.rules

Joe Patterson wrote:
> um, false.  The second variable definition would override the first, 
> which would leave you with the equivalent of:
>  
> alert tcp any 110 -> any any blah blah
> which is not what you want.
>  
> -Joe
>
>     -----Original Message-----
>     *From:* snort-sigs-admin () lists sourceforge net
>     [mailto:snort-sigs-admin () lists sourceforge net]*On Behalf Of *Esler,
>     Joel - Contractor
>     *Sent:* Wednesday, January 05, 2005 8:01 AM
>     *To:* snort-sigs () lists sourceforge net;
>     snort-users () lists sourceforge net
>     *Subject:* RE: [Snort-sigs] ports
>
>     you can't do a list of ports, the best you can do is something like
>      
>     ---snort.conf----
>     var SPECIFIC_PORT 21
>     var SPECIFIC_PORT 110
>      
>     then in your rule
>      
>     alert tcp any $SPECIFIC_PORT -> any any blah blah.
>
>         -----Original Message-----
>         *From:* snort-sigs-admin () lists sourceforge net
>         [mailto:snort-sigs-admin () lists sourceforge net] *On Behalf Of
>         *reynald
>         *Sent:* Tuesday, January 04, 2005 10:49 PM
>         *To:* snort-sigs () lists sourceforge net
>         *Cc:* Reynald Mahinay
>         *Subject:* [Snort-sigs] ports
>
>         Hello,
>          
>         How can i define a list of ports? eg. 25,110 doesn't work... Now
>         i know snort can do
>         port ranging, but how about a specific list of ports only.
>          
>         please help..thanks
>          
>          
>         reynald 


-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users