right, but that's not what you had. It makes a world of difference if you
write it as an equivalent to:
var SPECIFIC_PORT 21
alert tcp any $SPECIFIC_PORT -> any any blah blah.
var SPECIFIC_PORT 110
alert tcp any $SPECIFIC_PORT -> any any blah blah.
Because you're re-defining that variable between the invocations of the
rule. If you've only got one rule, it's kind of pointless to do it this
way. If you've got a bunch, it could be handy (i.e., you've got a bunch of
IIS servers listening on both port 80 and 8080, so you do:
var HTTP_PORT 80
include web-iis.rules
var HTTP_PORT 8080
include web-iis.rules
)
-Joe
-----Original Message-----
From: Jason [mailto:security@brvenik.com]
Sent: Wednesday, January 05, 2005 11:39 AM
To: Joe Patterson
Cc: snort-sigs@lists.sourceforge.net; snort-users@lists.sourceforge.net
Subject: Re: [Snort-users] RE: [Snort-sigs] ports
IIRC this is the the FAQ or the manual
var SPECIFIC_PORT 21
include port_list.rules
var SPECIFIC_PORT 110
include port_list.rules
Joe Patterson wrote:
um, false. The second variable definition would override the first,
which would leave you with the equivalent of:
alert tcp any 110 -> any any blah blah
which is not what you want.
-Joe
-----Original Message-----
*From:* snort-sigs-admin@lists.sourceforge.net
[mailto:snort-sigs-admin@lists.sourceforge.net]*On Behalf Of *Esler,
Joel - Contractor
*Sent:* Wednesday, January 05, 2005 8:01 AM
*To:* snort-sigs@lists.sourceforge.net;
snort-users@lists.sourceforge.net
*Subject:* RE: [Snort-sigs] ports
you can't do a list of ports, the best you can do is something like
---snort.conf----
var SPECIFIC_PORT 21
var SPECIFIC_PORT 110
then in your rule
alert tcp any $SPECIFIC_PORT -> any any blah blah.
-----Original Message-----
*From:* snort-sigs-admin@lists.sourceforge.net
[mailto:snort-sigs-admin@lists.sourceforge.net] *On Behalf Of
*reynald
*Sent:* Tuesday, January 04, 2005 10:49 PM
*To:* snort-sigs@lists.sourceforge.net
*Cc:* Reynald Mahinay
*Subject:* [Snort-sigs] ports
Hello,
How can i define a list of ports? eg. 25,110 doesn't work... Now
i know snort can do
port ranging, but how about a specific list of ports only.
please help..thanks
reynald
-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
