Ports
Port numbers may be specified by the keyword any, a single port number, ranges, and by negation. any specifies any port. Static ports are indicated by a single port number, for example, 23 for Telnet. Port ranges can be specified using a colon as a range operator. It can be applied in three ways, as shown by Table 15.
Table 15 Rules Containing the Port Number Range Operator
log udp any any
log tcp any :1024
•A colon between two port numbers indicates all ports between those ports, including the specified ports.
•A colon before a port number indicates all ports less than or equal to the specified port.
•A colon after a port number indicates all ports greater than or equal to the specifed port.
The negation operator can also be used in combination with port numbers. The rule in Table 16 logs all TCP traffic destined for ports other than port 6000 on the local network.
Table 16 Rules Containing the Port Number Negation Operator
log tcp any any
Note: The negation operator may not be placed before the keyword any. The ICMP protocol does not require a port number.
Direction Operator
The direction operator,
There is also a bidirectional operator, <>. This directs Snort to consider traffic originating from either of the specified addresses and ports. This operator can be used for analyzing both sides of a conversation. An example of the bidirectional operator being used to record both sides of a Telnet session is shown in Table 17.
Table 17 Rules Containing the Bidirectional Operator
log tcp !192.168.1.0/24 any <> 192.168.1.0/24 23
65 |
