Force10 Networks 100-00055-01 manual P-Series Rule Syntax, P-Series Supported Snort Keywords

Destination Address and Port

The destination address and port follow the direction operator. The syntax of these parameters are the same as the source address and port. See “Source Addresses” on page 64, and “Ports” on page 65.

Snort Rule Options

Options are made of a keyword and an argument. An argument is the packet data against which the rule is matched. Option keywords are followed by a colon, and each option is puncutated with a semi-colon. Table 19 lists the option keywords that the P-Series supports.

P-Series Rule Syntax

P-Series rules have a syntax that is slightly different from Snort rules. P-Series rules have the following syntax:

capture/forward_policy on channel Snort_rule

•capture/forward policy can have four values: alert, permit, divert, or deny. These settings are described in Table 5 on page 28.

•channel can be c0 for Channel 0, c1 for Channel 1, or all for both channels.

•Snort_rule is a rule written in Snort syntax.

Table 18 shows an example P-Series rule.

Table 18 P-Series Rule Example

alert on c1 any any -> any any (msg:"Z Default rule fragmented ip";)

Note: P-Series does not support the Snort action keywords log, pass, activate, and dynamic. P-Series supports the action keywords alert, permit, divert, and deny.

P-Series Supported Snort Keywords

Table 19 lists Snort keywords that the P-Series supports for both dynamic and static rules.

Table 19 Supported Snort Keywords for Static and Dynamic Rules

Keyword	Static	Dynamic
ack	Yes	Yes
content	Yes, no negative.	No

66 Writing Rules