Force10 Networks 100-00055-01 manual Protocol, Source Addresses

•pass directs Snort to ignore the packet.

•activate directs Snort to generate an alert and activate another specified rule.

•dynamic directs Snort to disregard the rule until it is activated by another rule. Once activated, the action defaults to log.

Note: The default actions for the P-Series are different from Snort. See “P-Series Rule Syntax” on page 66. The meaning of the Snort action keyword dynamic is not the same as P-Series dynamic rules. Dynamic rules in Snort are rules that must be activated, where as with the P-Series, dynamic rules are any rules that are uploaded to the FPGA without creating new firmware.

Protocol

Snort supports four protocols: tcp, udp, icmp, or ip. The protocol keyword follows the action keyword.

Source Addresses

The source address and port follow the protocol keyword. Addresses are written using dotted-decimal notation with the subnet mask in CIDR block notation. For example, the address/CIDR combination 192.168.1.0/24 signifies a block of addresses from 192.168.1.1 to 192.168.1.255. The keyword any may be used to define any source address.

The address field can be negated by placing an exclamation point before the address. This operator specifes all addresses other than the one contained in the rule. The rule in Table 13 indicates specifes all traffic originating from outside the local network and destined for the local network.

Note: The negation operator may not be placed before the keyword any.

Table 13 Rules Containing Address Negation

alert tcp !192.168.1.0/24 any -> 192.186.1.0/24 111(content:” 00 01 86 a5 ”; msg:”mounted access”;)

Lists of IP addresses can be specified by placing the addresses in brackets and separating each address with a comma; do not include spaces. Table 14 shows an example of a rule containing multiple addresses.

Table 14 Rules Containing Multiple IP Addresses

alert tcp ![192.168.1.0/24,10.1.1.0/24] any -> [192.186.1.0/24,10.1.1.0/24] 111(content:” 00 01 86 a5 ”;\ msg:”mounted access”;)

64 Writing Rules