OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Jonathan G. Lampe (jonathanstdnet.com)
Date: Tue Jun 05 2001 - 16:08:30 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    I want to write a pass rule which will ignore certain "well-behaved" UDP
    multicast packets on my local network. (The external router won't let them
    out with TTL<32.) I've gotten this far (I know <32 is illegal!):

    pass udp any 192.168.3.0/24 -> 224.0.0.0/8 (ttl: <32);

    I do not want the full multicast range (224.0.0.0-239.255.255.255) in my
    example , but I think the only way to do get the full range is to do the
    following. (Someone correct me if I'm wrong...)

    Complete SNORT Multicast Range (?)
    224.0.0.0/6, 228.0.0.0/5, 236.0.0.0/6

    _______________________________________________
    Snort-users mailing list
    Snort-userslists.sourceforge.net
    Go to this URL to change user options or unsubscribe:
    http://lists.sourceforge.net/lists/listinfo/snort-users
    Snort-users list archive:
    http://www.geocrawler.com/redir-sf.php3?list=snort-users