dst or src port

["alejandro corletti" <acorletti () hotmail com>]

My name is Alejandro Corletti, i am using snort to control GTP tunnel in 
GPRS traffic. I create many local rules with "pass udp determinate_IP_source 
3386 <> any any".  At the bottom of them there is an "alert udp any 3386 <> 
any any (msg: " NEW NETWORK";).   This local.rules control the Roaming 
partner´s traffic over tunnel GTP and if any to prove create a new tunnel in 
udp port 3386, snort to send a log.

My problem is: I want to control the possible connection with an 
determinate_IP_source whith udp "source OR destination" port 3386, without 
to duplicate all rules .

in tcpdump it is "tcpdump -i eth1 host determinate_IP_source and (src port 
3386 or dst port 3386)"

How can i do it in Snnort ?

_________________________________________________________________
Melodías, logos y mil servicios para tu teléfono en MSN Móviles.  
http://www.msn.es/MSNMovil/



-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users