Suresh,
This syntax is technically invalid. The range portion of your
construct is going to be ignored using this syntax. For example,
itype:> x <> y will be evaluated as itype:> x.
Thanks,
Justin Heath
On 4/4/07, Suresh Kumar J <suresh.kumar.j@gmail.com> wrote:
I wanted to hear from the Snort developers/experts about the validity
of the following usages of 'itype' and 'icode' constructs. These
options are accepted by the Snort 2.6 tool, but am not sure if they
make any sense:
itype:> x <> y
itype:< x <> y
itype:> x > y
itype:< x < y
--Suresh
On 4/4/07, Joel Esler <joel.esler@sourcefire.com> wrote:
When in doubt, test it out!
On Wed, Apr 04, 2007 at 12:38:20PM +0530, it looks like Suresh Kumar J sent
me:
Just to clarify, I have used '41' and '80' just as an example. My
question was on the syntax of the 'itype' and 'icode' constructs...
On 4/4/07, Suresh Kumar J <suresh.kumar.j@gmail.com> wrote:
Hi!
I have a question on the format of the 'icode' and 'itype' options
since it seems to cause confusion.
Below is the format of the 'itype' and 'icode' options as defined in
v2.6.x:
itype: [<|>]<number>[<><number>];
icode: [<|>]<number>[<><number>];
With this format, I know that the following options are valid:
(itype:<41;)
(itype:>80;)
(itype:41<>80;)
I wanted to know whether or not the following options are valid and
really make sense:
(itype:>41<80)
(itype:>41<>80)
(itype:<41<>80)
(itype:>41>80)
(itype:<41<80)
Appreciate your inputs.
--
Thanks and Regards,
Suresh Kumar J
--
Thanks and Regards,
Suresh Kumar J
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share
your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
+---------------------------------------------------------------------+
Joel Esler Security Consultant
gpg key: http://demo.sourcefire.com/jesler.pgp.key
+---------------------------------------------------------------------+
--
Thanks and Regards,
Suresh Kumar J
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
