Re: BPF question "port > 2000"?

[Sandro guly Zaccarini <guly () luv guly org>]

On Thu, Jan 20, 2011 at 10:17:01PM +1300, Jason Haar wrote:
> Hi there
>
> I'm wanting to filter a busy daemonlogger instance, and have tonnes of
> SKINNY VoIP traffic which is all udp, and src port > 2000 to dst port >
> 2000: I'd like to just ignore it.
>
> BPF doesn't appear to be able to filter ports with ">" or "<", so is
> there any way I can do this? Thanks

portrange 2001-65535?

sz
-- 
  /"\   taste your favourite IT consultant
  \ /   gpg public key http://www.guly.org/guly.asc
   X    
  / \   


------------------------------------------------------------------------------
Protect Your Site and Customers from Malware Attacks
Learn about various malware tactics and how to avoid them. Understand 
malware threats, the impact they can have on your business, and how you 
can protect your company and customers by using code signing.
http://p.sf.net/sfu/oracle-sfdevnl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users