Re: [Snort-sigs] Questions 101

From: Chris Green <cmg(at)sourcefire.com>
Date: Thu Apr 03 2003 - 16:04:49 EST

"Esler, Joel Contractor" <EslerJ@RCERT-S.ARMY.MIL> writes:

> To create a rule to look for specific IP's regardless of content would be???

alert ip 192.168.1.1 any -> $HOME_NET any (msg: "I want my... I want my... AYE PEA";)

-- 

Chris Green <cmg@sourcefire.com> "Not everyone holds these truths to be self-evident, so we've worked up a proof of them as Appendix A." -- Paul Prescod ------------------------------------------------------- This SF.net email is sponsored by: ValueWeb: Dedicated Hosting for just $79/mo with 500 GB of bandwidth! No other company gives more support or power for your dedicated server http://click.atdmt.com/AFF/go/sdnxxaff00300020aff/direct/01/ _______________________________________________ Snort-sigs mailing list Snort-sigs@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/snort-sigs Received on Thu Apr 3 16:39:57 2003