Format

Snort - the de facto standard for intrusion detection/prevention

the de facto standard for IPS

Search Site

Search Rules

Account

email
password

not registered?

user preferences

Next: Config Up: Variables Previous: Variables Contents

Format

var <name> <value>

**Figure 2.1:** Example of Variable Definition and Usage
$\begin{figure}\begin{verbatim}var MY_NET [192.168.1.0/24,10.1.1.0/24] alert tc... ...y -> $MY_NET any (flags:S; msg:''SYN packet'';)\end{verbatim} \par\end{figure}$

Rule variable names can be modified in several ways. You can define meta-variables using the $ operator. These can be used with the variable modifier operators ? and -, as described in the following table:

Variable Syntax Description

var Defines a meta-variable.

$(var) or $var Replaces with the contents of variable var.

$(var:-default) Replaces the contents of the variable var with ``default'' if var is undefined.

$(var:?message) Replaces with the contents of variable var or prints out the error message and exits.

See Figure 2.2 for an example of advanced variable usage in action.

**Figure 2.2:** Figure Advanced Variable Usage Example
$\begin{figure}\begin{verbatim}var MY_NET 192.168.1.0/24 log tcp any any -> $(MY_NET:?MY_NET is undefined!) 23\end{verbatim} \par\end{figure}$

Steven Sturges 2007-05-11