diff --git a/doc/snort_manual.tex b/doc/snort_manual.tex index 23111c0..abaccd0 100644 --- a/doc/snort_manual.tex +++ b/doc/snort_manual.tex @@ -1740,52 +1740,6 @@ Port variable used as an IP: alert tcp $EXAMPLE1 any -> any any (msg:"Example"; sid:5;) \end{verbatim} -\subsubsection{Variable Modifiers} - -Rule variable names can be modified in several ways. You can define -meta-variables using the \$ operator. These can be used with the variable -modifier operators {\tt ?} and {\tt -}, as described in the following table: - -\begin{center} -\begin{tabular}{| l | p{4.5in} |} - -\hline -\textbf{Variable Syntax} & \textbf{Description}\\ -\hline - -\hline -\texttt{var} & - -Defines a meta-variable.\\ - -\hline -\texttt{\$(var) or \$var} & - -Replaces with the contents of variable \texttt{var}.\\ - -\hline -\texttt{\$(var:-default)} & - -Replaces the contents of the variable \texttt{var} with ``default'' if -\texttt{var} is undefined.\\ - -\hline -\texttt{\$(var:?message)} & - -Replaces with the contents of variable \texttt{var} or prints out the error -message and exits.\\ - -\hline -\end{tabular} -\end{center} - -Here is an example of advanced variable usage in action: - -\begin{verbatim} - ipvar MY_NET 192.168.1.0/24 - log tcp any any -> $(MY_NET:?MY_NET is undefined!) 23 -\end{verbatim} - \subsubsection{Limitations} When embedding variables, types can not be mixed. For instance, port variables