RE: HTTP PORTS

[Matt Kettler <mkettler () evi-inc com>]

AFAIK snort supports comma delimited lists for IPs but they are NOT 
supported for ports.

Thus currently you can specify HTTP_PORTS as a single port, as a range (ie: 
HTTP_PORTS [80:88]) or as a negation of either of the above (ie: !25 or 
![20:25]), but [80,8080] is NOT supported.

See the docs for details on specifying ports in rules:

http://www.snort.org/docs/writing_rules/chap2.html#tth_sEc2.2.4


At 10:56 AM 2/4/2003 -0500, Morgan R. Elmore wrote:
> I believe the correct way to specify multiple ports would be:
> var HTTP_PORTS [80,8080]
>
> -----Original Message-----
> From: Darrin Powell [mailto:dpowell () lssi net]
> Sent: Tuesday, February 04, 2003 9:35 AM
> To: snort-users () lists sourceforge net
> Subject: [Snort-users] HTTP PORTS
>
>
> Is this the correct way to set HTTP_PORTS?
>
> # Ports you run web servers on
> var HTTP_PORTS 80 8080
>
> Thanks
> Darrin
>
>
>
>
>
> -------------------------------------------------------
> This SF.NET email is sponsored by:
> SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
> http://www.vasoftware.com _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
>
> -------------------------------------------------------
> This SF.NET email is sponsored by:
> SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
> http://www.vasoftware.com
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users