Snort mailing list archives
help: how to use binder to give different flow with different ips-rules ?
From: sofardware via Snort-users <snort-users () lists snort org>
Date: Wed, 13 Mar 2019 15:22:40 +0800 (CST)
Hi all,
For example,what I want to :
when source net = 1.1.1.1/16 ,use ips rule files:snort3-browser-ie.rules,snort3-browser-firefox.rules
when source net = 1.1.1.1/16 ,use ips rule
files:snort3-indicator-shellcode.rules,snort3-malware-backdoor.rules
How can use the flow binder :
string binder[].use.ips_policy: use ips policy from given file //what should be filled in the given file ?
The snort3 manual does not say what is ips_policy
ips =
{
include = 'snort3-browser-ie.rules'
} // Is this a ips_policy ??? ,if yes, what is the different to realize the above thing with
binder[].use.ips_policy and binder[].use.file ???
other help needed:
how can the follow binders be used? There is no detail help info or example in --help or manual
string binder[].use.inspection_policy: use inspection policy from given file
string binder[].use.network_policy: use network policy from given file
int binder[].when.ips_policy_id = 0: unique ID for selection of this config by external logic { 0: }
_______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: snort-users-leave () lists snort org Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
Current thread:
- help: how to use binder to give different flow with different ips-rules ? sofardware via Snort-users (Mar 13)
- new//Re:help: how to use binder to give different flow with different ips-rules ? sofardware via Snort-users (Mar 13)
- resoved//Re:new//Re:help: how to use binder to give different flow with different ips-rules ? sofardware via Snort-users (Mar 13)
- Re: new//Re:help: how to use binder to give different flow with different ips-rules ? Carter Waxman (cwaxman) via Snort-users (Mar 13)
- Re: new//Re:help: how to use binder to give different flow with different ips-rules ? Carter Waxman (cwaxman) via Snort-users (Mar 13)
- Re: new//Re:help: how to use binder to give different flow with different ips-rules ? sean murphy via Snort-users (Mar 13)
- new//Re:help: how to use binder to give different flow with different ips-rules ? sofardware via Snort-users (Mar 13)
