Snort - the de facto standard for intrusion detection/prevention
the de facto standard in IPS  
Got Source? About Snort About Sourcefire Snort FAQ
Sourcefire Network Security - the creators of Snort
Snort News Snort Downloads Snort Rules Snort Docs Snort Training Snort Forums Snort Community Snort Store
Search Site
Search Rules
Account
email
password
not registered?
can't login?
user preferences
next up previous contents
Next: The Direction Operator Up: Rules Headers Previous: IP Addresses   Contents

Port Numbers

Port numbers may be specified in a number of ways, including any ports, static port definitions, ranges, and by negation. Any ports are a wildcard value, meaning literally any port. Static ports are indicated by a single port number, such as 111 for portmapper, 23 for telnet, or 80 for http, etc. Port ranges are indicated with the range operator :. The range operator may be applied in a number of ways to take on different meanings, such as in Figure [*].

Figure: Port Range Examples
\begin{figure}\begin{verbatim}log udp any any -> 192.168.1.0/24 1:1024 log udp... ... or equal to 1024 going to ports greater than or equal to 500 \par\end{figure}

Port negation is indicated by using the negation operator !. The negation operator may be applied against any of the other rule types (except any, which would translate to none, how Zen...). For example, if for some twisted reason you wanted to log everything except the X Windows ports, you could do something like the rule in Figure [*].

Figure: Example of Port Negation
\begin{figure}\begin{verbatim}log tcp any any -> 192.168.1.0/24 !6000:6010\end{verbatim} \par\end{figure}

next up previous contents
Next: The Direction Operator Up: Rules Headers Previous: IP Addresses   Contents
Steven Sturges 2007-10-04
site feedback | Terms of Use | Privacy Policy | forum archives ©2008 Snort and Sourcefire are registered trademarks of Sourcefire, Inc. All rights reserved.