4.24 How can I define an address to be anything except some hosts?

Snort - the de facto standard for intrusion detection/prevention

the de facto standard in IPS

Search Site

Search Rules

Account

email
password

not registered?

user preferences

Next: 4.25 After I add Up: 4 Rules and Alerts Previous: 4.23 How can I

4.24 How can I define an address to be anything except some hosts?

Use the ! operator. E.g.:

    var EXTERNAL_NET !$HOME_NET

Note that the negation operator does not work inside a list so the following will NOT work:

    var EXTERNAL_NET [!192.168.40.0/24,!10.14.0.0/16]

but this will work:

    var EXTERNAL_NET ![192.168.40.0/24,10.14.0.0/16]