diff -Naurp snort-2.9.0.5.orig/doc/snort_manual.tex snort-2.9.0.5.advvar/doc/snort_manual.tex --- snort-2.9.0.5.orig/doc/snort_manual.tex 2011-03-25 19:24:28.000000000 +0000 +++ snort-2.9.0.5.advvar/doc/snort_manual.tex 2011-05-26 00:46:28.000067000 +0000 @@ -1638,52 +1638,6 @@ Port variable used as an IP: alert tcp $EXAMPLE1 any -> any any (msg:"Example"; sid:5;) \end{verbatim} -\subsubsection{Variable Modifiers} - -Rule variable names can be modified in several ways. You can define -meta-variables using the \$ operator. These can be used with the variable -modifier operators {\tt ?} and {\tt -}, as described in the following table: - -\begin{center} -\begin{tabular}{| l | p{4.5in} |} - -\hline -\textbf{Variable Syntax} & \textbf{Description}\\ -\hline - -\hline -\texttt{var} & - -Defines a meta-variable.\\ - -\hline -\texttt{\$(var) or \$var} & - -Replaces with the contents of variable \texttt{var}.\\ - -\hline -\texttt{\$(var:-default)} & - -Replaces the contents of the variable \texttt{var} with ``default'' if -\texttt{var} is undefined.\\ - -\hline -\texttt{\$(var:?message)} & - -Replaces with the contents of variable \texttt{var} or prints out the error -message and exits.\\ - -\hline -\end{tabular} -\end{center} - -Here is an example of advanced variable usage in action: - -\begin{verbatim} - ipvar MY_NET 192.168.1.0/24 - log tcp any any -> $(MY_NET:?MY_NET is undefined!) 23 -\end{verbatim} - \subsubsection{Limitations} When embedding variables, types can not be mixed. For instance, port variables