[Oisf-users] Negative options under var secitons on suricata

[Victor Julien]

On 03/18/2011 04:37 PM, carlopmart wrote:
> On 03/18/2011 03:59 PM, Victor Julien wrote:
>> On 03/18/2011 01:33 PM, carlopmart wrote:
>>> Hi all,
>>>
>>>    How can I assign a negative value under var sections on suricata? For
>>> example. I have two webservers listen on two different ports: 80 and
>>> 8089. How can I do ...
>>>
>>>    SHELLCODE_PORTS: "!80" ??
>>>
>>>    Like this: SHELLCODE_PORTS: "![80,8089]"??
>>>
>>>    I am using suricata-1.1beta1
>>>
>>
>> Should work ya, are you seeing a problem with it?
>>
>> Cheers,
>> Victor
>>
> 
> I didn't have test it ... But it works. One more question: where do I 
> need to configure https servers?? Do I need to create another variable 
> or put them on HTTP_SERVERS?? And ports used by these https servers, 
> under HTTP_PORTS??

You can just add that if you want. But I think it is only useful if
there are actually signatures that use that variable.

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------