What is the difference in using IPVAR and VAR ?

["Michael Steele" <michaels () winsnort com>]

I need some clarification on the usage of ipvar and var

The stock snort.conf  that comes with the rules has 'ipvar' set as the
default.

If I have ipv6 and ipv4 activated would I use ipvar and not var in the
snort.conf?- Snort would be IPV6 compiled

If I only have ipv4 activated,  would I use var in the snort.conf, or does
it matter if I use ipvar? - Snort would not be IPV6 compiled

Kindest regards,
Michael...


------------------------------------------------------------------------------
Get a FREE DOWNLOAD! and learn more about uberSVN rich system, 
user administration capabilities and model configuration. Take 
the hassle out of deploying and managing Subversion and the 
tools developers use with it. http://p.sf.net/sfu/wandisco-d2d-2
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!