Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Snort-Signatures
[Top] [All Lists]

RE: [Snort-sigs] ports

Subject: RE: [Snort-sigs] ports
Date: Wed, 5 Jan 2005 11:23:23 -0500
Messageum, false.  The second variable definition would override the first,
which would leave you with the equivalent of:

alert tcp any 110 -> any any blah blah
which is not what you want.

-Joe
  -----Original Message-----
  From: snort-sigs-admin@lists.sourceforge.net
[mailto:snort-sigs-admin@lists.sourceforge.net]On Behalf Of Esler, Joel -
Contractor
  Sent: Wednesday, January 05, 2005 8:01 AM
  To: snort-sigs@lists.sourceforge.net; snort-users@lists.sourceforge.net
  Subject: RE: [Snort-sigs] ports


  you can't do a list of ports, the best you can do is something like

  ---snort.conf----
  var SPECIFIC_PORT 21
  var SPECIFIC_PORT 110

  then in your rule

  alert tcp any $SPECIFIC_PORT -> any any blah blah.
    -----Original Message-----
    From: snort-sigs-admin@lists.sourceforge.net
[mailto:snort-sigs-admin@lists.sourceforge.net] On Behalf Of reynald
    Sent: Tuesday, January 04, 2005 10:49 PM
    To: snort-sigs@lists.sourceforge.net
    Cc: Reynald Mahinay
    Subject: [Snort-sigs] ports


    Hello,

    How can i define a list of ports? eg. 25,110 doesn't work... Now i know
snort can do
    port ranging, but how about a specific list of ports only.

    please help..thanks


    reynald
<Prev in Thread] Current Thread [Next in Thread>