Snort mailing list archives
Re: Snort Rules & Variables
From: Joel Esler <eslerj () gmail com>
Date: Thu, 7 Jul 2005 17:17:36 -0400
And you can either have CIDR or not have CIDR, but you have to eliminate your space, as Bruce said.
Joel On Jul 7, 2005, at 5:10 PM, Briggs, Bruce wrote:
You can have a comma separated list, no spaces, within brackets. MAIL_SOURCES: [111.222.222.24,111.222.225.10] BruceFrom: snort-users-admin () lists sourceforge net [mailto:snort-users- admin () lists sourceforge net] On Behalf Of Pennell, Ronald B.Sent: Thursday, July 07, 2005 3:01 PM To: snort-users () lists sourceforge net Subject: [Snort-users] Snort Rules & VariablesWhen using a variable to specify specific IP addresses can you just list the IP addresses themselves without the range?Ie: MAIL_SOURCES: [111.222.222.24, 111.222.225.10] – or do you need to specify the CIDR as part of the address?Ron
Current thread:
- Snort Rules & Variables Pennell, Ronald B. (Jul 07)
- <Possible follow-ups>
- RE: Snort Rules & Variables Briggs, Bruce (Jul 07)
- Re: Snort Rules & Variables Joel Esler (Jul 07)