Jason wrote:
Matt Kettler wrote:
Jason wrote:
Hi Matt,
Thanks for your comments. I don't understand why these packets are
"no different". The MY_HTTP_PORTS variable includes 8000. If I
negate MY_HTTP_PORTS in my rule, why do I get an alert on
192.168.2.105:50970 -> 192.168.2.103:8000? Is it because port 8000 in
the packet is not other ports in the variable, like 80, 81, etc.?
NOTE: I've not had a chance to look at the code, I could be wrong,
please verify.
I think there may two issues working together.
1) not(80 and 81 and 82...) is different than (not 81 and not 81...)
2) not(80 and 81 and 82...) will always be true
By that same logic, [80,81,82..] aka (80 and 81 and 82) would always be
false, which would make the syntax completely worthless.
AFAIK, all the "comma" operators are OR operators, not AND. It's the
only sensible operator to use here.
so ![80,81,82..] is:
not (80 or 81 or 82)
and it should work the way you expect.
However, with OR you have to be careful of trying to negate inside the
brackets,
ie: [!80,!81,!82..] would become:
(not 80) or (not 81) or (not 82)
which is always true...
I readily admit I did not put a lot of thought into it. So... Which way
is it?
A comma inside the [] for a port or IP on a rule is an OR operator, and a
BOOLEAN OR at that.
It CANNOT be an AND, as it would be dysfunctional to the point of making any
rule using [a,b] completely pointless. It would never match anything if a and b
were not equal, and at that point, it is stupid.
Your large table of operations confuses me greatly, but it may be because I
don't understand your syntax.
(80 == !(80 || 80)) : 0
!(80 == (80 || 80)) : 1
What are those two supposed to represent, logically speaking, and how do they
differ?
From my C-code centered view I read (80 == !(80 || 80)) as:
(80 "is equal to" not ( 80 BOOLEAN OR 80))
Which is nonsense. You don't boolean OR together two integers. You can, but
it's
pointless nonsense.
using [80,81] in for a dport rule would be read as:
match if dport is equal to 80 or dport is equal to 81.
Which I would express as:
(dport == 80 || dport == 81)
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
