This is Interesting: Free IT Magazines  
Home > Archive > Snort > September 2004 > [Snort-users] The System works !! one question please !





You are viewing an archived Text-only version of the thread. To view this thread in it's original format and/or if you want to reply to this thread please [click here]

Author [Snort-users] The System works !! one question please !
Juan Fernandez

2004-09-22, 10:25 pm

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------_=_NextPart_001_01C49EF9.BCA2A22C
Content-Type: text/plain

Hi,





I tried to insert all of my http servers in HTTP_SERVERS in snort.conf (I
have a 99 servers).



Before modifying the https servers it worked.



DO I have a limitation of ip to enter ( I cant find any syntax error).



After I insert those ip's and started snort I received the following error
in /var/log/messeges:



Sep 20 12:20:12 sensjrlan snort: FATAL ERROR: /etc/snort/snort.conf(66) =>
Unknown rule type:
70.171.150,208.170.171.152,208.170.171.154,208.170.171.157,208.170.171.160,2
08.170.171.166,208.170.171.171,208.170.171.188,208.170.171.199,208.170.171.2
02,208.170.171.210,208.170.171.224,212.127.71.22,212.127.71.24,212.127.71.20
,212.127.71.21,212.127.71.22,212.127.71.24,212.127.71.44,212.127.71.45,212.1
27.71.52,212.127.71.81,212.127.71.99,212.127.71.100,212.127.71.102,212.127.7
1.111,212.127.71.112,212.127.71.112,212.127.71.117,212.127.71.119,212.127.71
..140,212.127.71.212]

~

This is the relevant section in snort.conf ( line 65 starts in "var HTTP.."
and line 66 in the empty line after all the ip list):









var HTTP_SERVERS
[212.127.72.16,212.127.72.26,212.127.72.27,212.127.72.42,212.127.72.48,212.1
27.72.49,212.127.72.55,212.127.72.55,212.127.72.57,212.127.72.58,212.127.72.
76,212.127.72.92,212.127.72.98,212.127.72.100,212.127.72.107,212.127.72.108,
212.127.72.111,212.127.72.112,212.127.72.112,212.127.72.122,212.127.72.122,2
12.127.72.124,212.127.72.142,212.127.72.152,212.127.72.210,212.127.70.5,212.
127.70.17,212.127.70.21,208.170.171.7,208.170.171.12,208.170.171.12,208.170.
171.15,208.170.171.17,208.170.171.22,208.170.171.24,208.170.171.27,208.170.1
71.28,208.170.171.21,208.170.171.22,208.170.171.26,208.170.171.27,208.170.17
1.42,208.170.171.46,208.170.171.48,208.170.171.49,208.170.171.57,208.170.171
..61,208.170.171.65,208.170.171.66,208.170.171.72,208.170.171.77,208.170.171.
78,208.170.171.82,208.170.171.95,208.170.171.101,208.170.171.105,208.170.171
..110,208.170.171.111,208.170.171.112,208.170.171.115,208.170.171.119,208.170
..171.120,208.170.171.122,208.170.171.121,208.170.171.126,208.170.171.127,208
..170.171.142,208.170.171.150,208.170.171.152,208.170.171.154,208.170.171.157
,208.170.171.160,208.170.171.166,208.170.171.171,208.170.171.188,208.170.171
..199,208.170.171.202,208.170.171.210,208.170.171.224,212.127.71.22,212.127.7
1.24,212.127.71.20,212.127.71.21,212.127.71.22,212.127.71.24,212.127.71.44,2
12.127.71.45,212.127.71.52,212.127.71.81,212.127.71.99,212.127.71.100,212.12
7.71.102,212.127.71.111,212.127.71.112,212.127.71.112,212.127.71.117,212.127
..71.119,212.127.71.140,212.127.71.212]



thanks !!

~


------_=_NextPart_001_01C49EF9.BCA2A22C
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable

<html xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns=3D"http://www.w3.org/TR/REC-html40">

<head>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">


<meta name=3DGenerator content=3D"Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
text-align:right;
direction:rtl;
unicode-bidi:embed;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:595.3pt 841.9pt;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>

</head>

<body lang=3DEN-US link=3Dblue vlink=3Dpurple>

<div class=3DSection1 dir=3DRTL>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'>Hi,<o:p></o:p></span></font=
></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></f=
ont></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></f=
ont></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'>I
tried to insert all of my http servers in HTTP_SERVERS in snort.conf (I =
have a 99
servers).<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></f=
ont></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'>Before
modifying the https servers it worked.<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></f=
ont></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'>DO
I have a limitation of ip to enter ( I cant find any syntax =
error).<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></f=
ont></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'>After
I insert those ip's &nbsp;and started snort I received the following =
error in
/var/log/messeges: <o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></f=
ont></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'>Sep
20 12:20:12 sensjrlan snort: FATAL ERROR: /etc/snort/snort.conf(66) =
=3D&gt; Unknown
rule type: =
70.171.150,208.170.171.152,208.170.171.154,208.170.171.157,208.170.171.1=
60,208.170.171.166,208.170.171.171,208.170.171.188,208.170.171.199,208.1=
70.171.202,208.170.171.210,208.170.171.224,212.127.71.22,212.127.71.24,2=
12.127.71.20,212.127.71.21,212.127.71.22,212.127.71.24,212.127.71.44,212=
..127.71.45,212.127.71.52,212.127.71.81,212.127.71.99,212.127.71.100,212=
..127.71.102,212.127.71.111,212.127.71.112,212.127.71.112,212.127.71.117=
,212.127.71.119,212.127.71.140,212.127.71.212]</span></font><font
size=3D2 face=3DArial><span lang=3DHE dir=3DRTL =
style=3D'font-size:10.0pt;font-family:
Arial'><o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><span dir=3DLTR></span><font size=3D2 face=3DArial><span =
style=3D'font-size:
10.0pt;font-family:Arial'><span dir=3DLTR></span>~</span></font><font =
size=3D2
face=3DArial><span lang=3DHE dir=3DRTL =
style=3D'font-size:10.0pt;font-family:Arial'><o:p></o:p></span></font></=
p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'>This
is the relevant section in snort.conf ( line 65 starts in "var =
HTTP.."
and line 66 in the empty line after all the ip =
list):<o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></f=
ont></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></f=
ont></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></f=
ont></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></f=
ont></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'>var
HTTP_SERVERS =
[212.127.72.16,212.127.72.26,212.127.72.27,212.127.72.42,212.127.72.48,2=
12.127.72.49,212.127.72.55,212.127.72.55,212.127.72.57,212.127.72.58,212=
..127.72.76,212.127.72.92,212.127.72.98,212.127.72.100,212.127.72.107,21=
2.127.72.108,212.127.72.111,212.127.72.112,212.127.72.112,212.127.72.122=
,212.127.72.122,212.127.72.124,212.127.72.142,212.127.72.152,212.127.72.=
210,212.127.70.5,212.127.70.17,212.127.70.21,208.170.171.7,208.170.171.1=
2,208.170.171.12,208.170.171.15,208.170.171.17,208.170.171.22,208.170.17=
1.24,208.170.171.27,208.170.171.28,208.170.171.21,208.170.171.22,208.170=
..171.26,208.170.171.27,208.170.171.42,208.170.171.46,208.170.171.48,208=
..170.171.49,208.170.171.57,208.170.171.61,208.170.171.65,208.170.171.66=
,208.170.171.72,208.170.171.77,208.170.171.78,208.170.171.82,208.170.171=
..95,208.170.171.101,208.170.171.105,208.170.171.110,208.170.171.111,208=
..170.171.112,208.170.171.115,208.170.171.119,208.170.171.120,208.170.17=
1.122,208.170.171.121,208.170.171.126,208.170.171.127,208.170.171.142,20=
8.170.171.150,208.170.171.152,208.170.171.154,208.170.171.157,208.170.17=
1.160,208.170.171.166,208.170.171.171,208.170.171.188,208.170.171.199,20=
8.170.171.202,208.170.171.210,208.170.171.224,212.127.71.22,212.127.71.2=
4,212.127.71.20,212.127.71.21,212.127.71.22,212.127.71.24,212.127.71.44,=
212.127.71.45,212.127.71.52,212.127.71.81,212.127.71.99,212.127.71.100,2=
12.127.71.102,212.127.71.111,212.127.71.112,212.127.71.112,212.127.71.11=
7,212.127.71.119,212.127.71.140,212.127.71.212]<o:p></o:p></span></font>=
</p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'><o:p>&nbsp;</o:p></span></f=
ont></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'>thanks
!!</span></font><font size=3D2 face=3DArial><span lang=3DHE dir=3DRTL =
style=3D'font-size:
10.0pt;font-family:Arial'><o:p></o:p></span></font></p>

<p class=3DMsoNormal dir=3DLTR =
style=3D'text-align:left;direction:ltr;unicode-bidi:
embed'><span dir=3DLTR></span><font size=3D2 face=3DArial><span =
style=3D'font-size:
10.0pt;font-family:Arial'><span =
dir=3DLTR></span>~<o:p></o:p></span></font></p>

</div>

</body>

</html>

------_=_NextPart_001_01C49EF9.BCA2A22C--


-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users
Alex Butcher, ISC/ISYS

2004-09-22, 10:25 pm



--On 20 September 2004 13:08 +0300 Juan Fernandez
<Juan.Fernandez@deltathree.com> wrote:

> I tried to insert all of my http servers in HTTP_SERVERS in snort.conf (I
> have a 99 servers).
>
> Before modifying the https servers it worked.
>
> DO I have a limitation of ip to enter ( I cant find any syntax error).

It looks like Snort's configuration file parser has a maximum line length
of 1024 characters (defined by STD_BUF in src/snort.h). To (try to) change
this, you'll need to modify that definition in snort.h and rebuild.

Alternatively, a workaround would be to define two or more variables, and
duplicate the signatures that use HTTP_SERVERS.

HTH,
Alex.
--
Alex Butcher: Security & Integrity, Personal Computer Systems Group
Information Systems and Computing GPG Key ID: F9B27DC9
GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9




-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users
Harper, Patrick

2004-09-22, 10:25 pm

Can you use cidr? I am not sure if there is a limit or not but would
imagine there is.=20

=20
-----Original Message-----
From: Juan Fernandez [mailto:Juan.Fernandez@deltathree.com]=20
Sent: Monday, September 20, 2004 5:08 AM
To: 'snort-users@lists.sourceforge.net'
Subject: [Snort-users] The System works !! one question please !

Hi,

=20

=20

I tried to insert all of my http servers in HTTP_SERVERS in snort.conf
(I have a 99 servers).

=20

Before modifying the https servers it worked.

=20

DO I have a limitation of ip to enter ( I cant find any syntax error).

=20

After I insert those ip's and started snort I received the following
error in /var/log/messeges:=20

=20

Sep 20 12:20:12 sensjrlan snort: FATAL ERROR: /etc/snort/snort.conf(66)
=3D> Unknown rule type:
70.171.150,208.170.171.152,208.170.171.154,208.170.171.157,208.170.171.1
60,208.170.171.166,208.170.171.171,208.170.171.188,208.170.171.199,208.1
70.171.202,208.170.171.210,208.170.171.224,212.127.71.22,212.127.71.24,2
12.127.71.20,212.127.71.21,212.127.71.22,212.127.71.24,212.127.71.44,212
=2E127.71.45,212.127.71.52,212.127.71.81,212.127.71.99,212.127.71.100,212.
127.71.102,212.127.71.111,212.127.71.112,212.127.71.112,212.127.71.117,2
12.127.71.119,212.127.71.140,212.127.71.212]

~

This is the relevant section in snort.conf ( line 65 starts in "var
HTTP.." and line 66 in the empty line after all the ip list):

=20

=20

=20

=20

var HTTP_SERVERS
[212.127.72.16,212.127.72.26,212.127.72.27,212.127.72.42,212.127.72.48,2
12.127.72.49,212.127.72.55,212.127.72.55,212.127.72.57,212.127.72.58,212
=2E127.72.76,212.127.72.92,212.127.72.98,212.127.72.100,212.127.72.107,212
=2E127.72.108,212.127.72.111,212.127.72.112,212.127.72.112,212.127.72.122,
212.127.72.122,212.127.72.124,212.127.72.142,212.127.72.152,212.127.72.2
10,212.127.70.5,212.127.70.17,212.127.70.21,208.170.171.7,208.170.171.12
,208.170.171.12,208.170.171.15,208.170.171.17,208.170.171.22,208.170.171
=2E24,208.170.171.27,208.170.171.28,208.170.171.21,208.170.171.22,208.170.
171.26,208.170.171.27,208.170.171.42,208.170.171.46,208.170.171.48,208.1
70.171.49,208.170.171.57,208.170.171.61,208.170.171.65,208.170.171.66,20
8.170.171.72,208.170.171.77,208.170.171.78,208.170.171.82,208.170.171.95
,208.170.171.101,208.170.171.105,208.170.171.110,208.170.171.111,208.170
=2E171.112,208.170.171.115,208.170.171.119,208.170.171.120,208.170.171.122
,208.170.171.121,208.170.171.126,208.170.171.127,208.170.171.142,208.170
=2E171.150,208.170.171.152,208.170.171.154,208.170.171.157,208.170.171.160
,208.170.171.166,208.170.171.171,208.170.171.188,208.170.171.199,208.170
=2E171.202,208.170.171.210,208.170.171.224,212.127.71.22,212.127.71.24,212
=2E127.71.20,212.127.71.21,212.127.71.22,212.127.71.24,212.127.71.44,212.1
27.71.45,212.127.71.52,212.127.71.81,212.127.71.99,212.127.71.100,212.12
7.71.102,212.127.71.111,212.127.71.112,212.127.71.112,212.127.71.117,212
=2E127.71.119,212.127.71.140,212.127.71.212]

=20

thanks !!

~





Disclaimer:
This electronic message, including any attachments, is confidential and int=
ended solely for use of the intended recipient(s). This message may contain=
information that is privileged or otherwise protected from disclosure by a=
pplicable law. Any unauthorized disclosure, dissemination, use or reproduct=
ion is strictly prohibited. If you have received this message in error, ple=
ase delete it and notify the sender immediately.=20





-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users
Juan Fernandez

2004-09-22, 10:25 pm

The problem if I use cidr is that in the range there will be ip's that they
don't have http servers on tham .

What will be the result of that ?

I am trying to reduce false positives...

I received another replay from Alex.Butcher he is offering the folowing :

It looks like Snort's configuration file parser has a maximum line length of
1024 characters (defined by STD_BUF in src/snort.h). To (try to) change
this, you'll need to modify that definition in snort.h and rebuild.

Alternatively, a workaround would be to define two or more variables, and
duplicate the signatures that use HTTP_SERVERS.


I am afraid to compile again... after so much work it took me to start it
working...

What u soggest ?

Thanks !!

I am reading the book of jack koziol.

-----Original Message-----
From: Harper, Patrick [mailto:patrick.harper@phns.com]
Sent: Monday, September 20, 2004 4:32 PM
To: Juan Fernandez; snort-users@lists.sourceforge.net
Subject: RE: [Snort-users] The System works !! one question please !

Can you use cidr? I am not sure if there is a limit or not but would
imagine there is.


-----Original Message-----
From: Juan Fernandez [mailto:Juan.Fernandez@deltathree.com]
Sent: Monday, September 20, 2004 5:08 AM
To: 'snort-users@lists.sourceforge.net'
Subject: [Snort-users] The System works !! one question please !

Hi,





I tried to insert all of my http servers in HTTP_SERVERS in snort.conf
(I have a 99 servers).



Before modifying the https servers it worked.



DO I have a limitation of ip to enter ( I cant find any syntax error).



After I insert those ip's and started snort I received the following
error in /var/log/messeges:



Sep 20 12:20:12 sensjrlan snort: FATAL ERROR: /etc/snort/snort.conf(66)
=> Unknown rule type:
70.171.150,208.170.171.152,208.170.171.154,208.170.171.157,208.170.171.1
60,208.170.171.166,208.170.171.171,208.170.171.188,208.170.171.199,208.1
70.171.202,208.170.171.210,208.170.171.224,212.127.71.22,212.127.71.24,2
12.127.71.20,212.127.71.21,212.127.71.22,212.127.71.24,212.127.71.44,212
..127.71.45,212.127.71.52,212.127.71.81,212.127.71.99,212.127.71.100,212.
127.71.102,212.127.71.111,212.127.71.112,212.127.71.112,212.127.71.117,2
12.127.71.119,212.127.71.140,212.127.71.212]

~

This is the relevant section in snort.conf ( line 65 starts in "var
HTTP.." and line 66 in the empty line after all the ip list):









var HTTP_SERVERS
[212.127.72.16,212.127.72.26,212.127.72.27,212.127.72.42,212.127.72.48,2
12.127.72.49,212.127.72.55,212.127.72.55,212.127.72.57,212.127.72.58,212
..127.72.76,212.127.72.92,212.127.72.98,212.127.72.100,212.127.72.107,212
..127.72.108,212.127.72.111,212.127.72.112,212.127.72.112,212.127.72.122,
212.127.72.122,212.127.72.124,212.127.72.142,212.127.72.152,212.127.72.2
10,212.127.70.5,212.127.70.17,212.127.70.21,208.170.171.7,208.170.171.12
,208.170.171.12,208.170.171.15,208.170.171.17,208.170.171.22,208.170.171
..24,208.170.171.27,208.170.171.28,208.170.171.21,208.170.171.22,208.170.
171.26,208.170.171.27,208.170.171.42,208.170.171.46,208.170.171.48,208.1
70.171.49,208.170.171.57,208.170.171.61,208.170.171.65,208.170.171.66,20
8.170.171.72,208.170.171.77,208.170.171.78,208.170.171.82,208.170.171.95
,208.170.171.101,208.170.171.105,208.170.171.110,208.170.171.111,208.170
..171.112,208.170.171.115,208.170.171.119,208.170.171.120,208.170.171.122
,208.170.171.121,208.170.171.126,208.170.171.127,208.170.171.142,208.170
..171.150,208.170.171.152,208.170.171.154,208.170.171.157,208.170.171.160
,208.170.171.166,208.170.171.171,208.170.171.188,208.170.171.199,208.170
..171.202,208.170.171.210,208.170.171.224,212.127.71.22,212.127.71.24,212
..127.71.20,212.127.71.21,212.127.71.22,212.127.71.24,212.127.71.44,212.1
27.71.45,212.127.71.52,212.127.71.81,212.127.71.99,212.127.71.100,212.12
7.71.102,212.127.71.111,212.127.71.112,212.127.71.112,212.127.71.117,212
..127.71.119,212.127.71.140,212.127.71.212]



thanks !!

~





Disclaimer:
This electronic message, including any attachments, is confidential and
intended solely for use of the intended recipient(s). This message may
contain information that is privileged or otherwise protected from
disclosure by applicable law. Any unauthorized disclosure, dissemination,
use or reproduction is strictly prohibited. If you have received this
message in error, please delete it and notify the sender immediately.




-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users
Sponsored Links






Free braindumps | Software forum | Database administration forum

Copyright 2003 - 2010 webservertalk.com