Re: [Snort-users] Network variables are not preserved when using LightSPD rules

["Oleksii Shumeiko -X \(oshumeik - SOFTSERVE INC at Cisco\) via Snort-sigs" <snort-sigs () lists snort org>]

Hi,

> over-ride them before the script is called

You can override variables after the script is called.
Just put the following lines at the end of the main config file (snort.lua):

ips.variables.net.HOME_NET = 'x.x.x.x/z'
ips.variables.net.DNS_SERVERS = 'y.y.y.y'
ips.variables.net.EXTERNAL_NET = 'any'
ips.variables.net.FTP_SERVERS = HOME_NET
ips.variables.net.HTTP_SERVERS = HOME_NET
ips.variables.net.SIP_SERVERS = HOME_NET
ips.variables.net.SMTP_SERVERS = HOME_NET
ips.variables.net.SQL_SERVERS = HOME_NET
ips.variables.net.SSH_SERVERS = HOME_NET
ips.variables.net.TELNET_SERVERS = HOME_NET

Port variables can be overridden the same way:
ips.variables.ports.NN = 12345


Regards,
Alexey

On 26 Sep 2024, at 13:11, Dheeraj Gupta via Snort-users <snort-users () lists snort org> wrote:

over-ride them before the script is called

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists snort org
https://lists.snort.org/mailman/listinfo/snort-sigs

Please visit http://blog.snort.org for the latest news about Snort!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a 
href=" https://snort.org/downloads/#rule-downloads";>emerging threats</a>!