RE: [Snort-sigs] exclude IP from a rule

From: Esler, Joel Contractor <joel.esler(at)rcert-s.army.mil>
Date: Tue Sep 23 2003 - 08:32:57 EDT

pass udp $EXTERNAL_NET any -> <IP> 161 (msg:"SNMP..............

-----Original Message-----
From: Nick Duda [mailto:nduda@VistaPrint.com] Sent: Tuesday, September 23, 2003 7:51 AM To: snort-sigs@lists.sourceforge.net
Subject: [Snort-sigs] exclude IP from a rule

Hi,
I have a sig (below) that grabs SNMP traffic. How can I exclude 1 internal IP from the rule?  

alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"SNMP request udp"; reference:cve,CAN-2002-0012; reference:cve,CAN-2002-0013; sid:1417; rev:2; classtype:attempted-recon;)

thanks in advanced

Nick Duda, CCSA, Security+
Systems Administrator
* Email: nduda@vistaprint.com <mailto:nduda@vistaprint.com>  

---

This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven.
http://thinkgeek.com/sf

---

Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs Received on Tue Sep 23 08:50:11 2003