<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 9.00.8112.16450">
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2 face=Arial>
<DIV><FONT size=2 face=Arial>I want to check subnet but exclude one ip
.</FONT></DIV>
<DIV> </DIV><FONT size=2 face=Arial>
<DIV><BR>I've read a documentation at <A
href="">https://redmine.openinfosecfoundatio...Suricata_Rules</A> and report
this example :</DIV>
<DIV> </DIV>
<DIV></FONT> </DIV>
<DIV><FONT size=2 face=Arial></FONT></DIV>
<DIV></DIV>
<DIV><FONT size=2 face=Arial>[10.0.0.0/24, !10.0.0.5] (10.0.0.0/24 except for
10.0.0.5)</FONT></DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV></DIV>
<DIV><FONT size=2 face=Arial>Now, in my suricata configuration I've set HOME_NET
wit :</FONT></DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV><FONT size=2 face=Arial></FONT></DIV>
<DIV><FONT size=2 face=Arial></FONT></DIV>
<DIV><FONT size=2 face=Arial>HOME_NET: "[10.10.10.0/24,
!10.10.10.247]"</FONT></DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV><FONT size=2 face=Arial></FONT></DIV>
<DIV><FONT size=2 face=Arial></FONT></DIV>
<DIV><FONT size=2 face=Arial>But, when I start suricata receive this error
:</FONT></DIV>
<DIV><FONT size=2 face=Arial></FONT></DIV><FONT size=2 face=Arial>
<DIV> </DIV>
<DIV><BR>12/8/2013 -- 08:56:09 - <Error> - [ERRCODE:
SC_ERR_ADDRESS_ENGINE_GENERIC(89)] - failed to parse address "
10.10.10.247"<BR>12/8/2013 -- 08:56:09 - <Error> - [ERRCODE:
SC_ERR_INVALID_YAML_CONF_ENTRY(139)] - failed to parse address var "HOME_NET"
with value "[10.10.10.0/24, !10.10.10.247]". Please check it's
syntax<BR>12/8/2013 -- 08:56:09 - <Error> - [ERRCODE:
SC_ERR_INVALID_YAML_CONF_ENTRY(139)] - basic address vars test failed. Please
check /etc/suricata/suricata.yaml for errors</DIV>
<DIV><BR> </DIV></FONT>
<DIV><FONT size=2 face=Arial>I've Suricata version 1.4.5 RELEASE .</FONT></DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV><FONT size=2 face=Arial></FONT></DIV>
<DIV><FONT size=2 face=Arial></FONT></DIV>
<DIV><FONT size=2 face=Arial>How can I exclude one ip from check, what is
correct syntax .</FONT></DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV><FONT size=2 face=Arial></FONT></DIV>
<DIV><FONT size=2 face=Arial></FONT></DIV>
<DIV><FONT size=2 face=Arial>Thanks</FONT></DIV></FONT></DIV></BODY></HTML>