Re: !Multiple Ports

[Mohamed LRHAZI <mohamed () lrhazi com>]

On Tuesday 17 July 2001 16:17, Tim Olson wrote:
> How could someone watch and log all traffic coming FROM a machine to
> ANY machine, except for multiple destination ports?
>
> Example:
>
> log tcp 192.168.0.7/32 any -> 192.168.0.0/24 ![22,23,110,25]
> (logto:"test.log";)
>
> It doesn't accept multiple multiple single destination ports.
> I could do a range, but in this example I'd be missing out on a lot of
> ports
> between 25 and 110.

How about you tried catching all ranges expilicitly. instead of avoinding specific ports :

var MAXPORT=whatever-that-interger-is

log tcp 192.168.0.7/32 any -> 192.168.0.0/24 0-21  (logto:"test.log";)
log tcp 192.168.0.7/32 any -> 192.168.0.0/24 23-24  (logto:"test.log";)
log tcp 192.168.0.7/32 any -> 192.168.0.0/24 26-109  (logto:"test.log";)
log tcp 192.168.0.7/32 any -> 192.168.0.0/24 111-$MAXPORT (logto:"test.log";)

Mohamed~
> Tim
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users