RE: home_net and ext_net question

[Neil Dickey <neil () geol niu edu>]

Matt Kettler <mkettler () evi-inc com> wrote:

> It will do funny things if you try to do HOME_NET as a comma-delimited list 
> and forget to put ['s around it. Otherwise it should be fine.

If HOME_NET is defined thus ...

      var HOME_NET any

... and EXTERNAL_NET as follows ...

      var EXTERNAL_NET !$HOME_NET

... then will a rule written like this ...

      alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"Whatever";)

... ever match?  Alternatively, if EXTERNAL_NET is set this way ...

      var EXTERNAL_NET $HOME_NET

... would such a rule match on everything that comes past?  Recent
posts on the list have shown these variables set the latter way, and
I'm not sure why anyone would do that.

Best regards,

Neil Dickey, Ph.D.
Research Associate/Sysop
Geology Department
Northern Illinois University
DeKalb, Illinois
60115




-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users