Re: var or ipvar?

[Joel Esler <jesler () sourcefire com>]

On Jan 28, 2013, at 3:36 PM, waldo kitty <wkitty42 () windstream net> wrote:
> On 1/28/2013 15:10, Joel Esler wrote:
> > Ipvar, for ips. Portvar for ports.
>
> i love bikini answers! short and to the point ;)
Sorry, was on my iPad.

> but in this case, i'm needing a bit more information, please...
>
> ipvar was started being used for IPv6 at what version of snort?

Um.  I want to say 2.6.0?  

> ipvar was started being used for both IPv4 and IPv6 at what version of snort?

You've always been able to use both.  What you haven't been able to do is use var for ipv6 addresses.  2.9.3.0 enabled 
ipv6 by default, and 2.9.4.0 removed the separate code paths.

> var was no longer for IPv4 used at what version of snort?

It always has been.  But we've eliminated the difference now.

> and lastly this question from the previous post...
>
> will older snorts fall over because of ipvar being introduced into their 
> environment before they are ready for it?

If it's not compiled with --enable-ipv6, yes.  But if you compiled ipv6 in, you should be good to go.

--
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire

------------------------------------------------------------------------------
Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
MVPs and experts. ON SALE this month only -- learn more at:
http://p.sf.net/sfu/learnnow-d2d

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!