Received: by 10.101.197.23 with SMTP id z23mr796682anp.48.1321621501322;
        Fri, 18 Nov 2011 05:05:01 -0800 (PST)
X-BeenThere: snortusers@googlegroups.com
Received: by 10.101.2.12 with SMTP id e12ls3432059ani.3.gmail; Fri, 18 Nov
 2011 05:04:58 -0800 (PST)
Received: by 10.236.46.130 with SMTP id r2mr4490692yhb.7.1321621498635;
        Fri, 18 Nov 2011 05:04:58 -0800 (PST)
Received: by 10.150.243.2 with SMTP id q2msybh;
        Fri, 18 Nov 2011 00:29:30 -0800 (PST)
Received: by 10.101.67.13 with SMTP id u13mr604191ank.11.1321604970061;
        Fri, 18 Nov 2011 00:29:30 -0800 (PST)
Received: by 10.101.67.13 with SMTP id u13mr604190ank.11.1321604970045;
        Fri, 18 Nov 2011 00:29:30 -0800 (PST)
Return-Path: <kevros...@googlemail.com>
Received: from mail-yw0-f46.google.com (mail-yw0-f46.google.com [209.85.213.46])
        by gmr-mx.google.com with ESMTPS id d63si15053yhe.2.2011.11.18.00.29.30
        (version=TLSv1/SSLv3 cipher=OTHER);
        Fri, 18 Nov 2011 00:29:30 -0800 (PST)
Received-SPF: pass (google.com: domain of kevros...@googlemail.com designates 209.85.213.46 as permitted sender) client-ip=209.85.213.46;
Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of kevros...@googlemail.com designates 209.85.213.46 as permitted sender) smtp.mail=kevros...@googlemail.com; dkim=pass (test mode) header...@googlemail.com
Received: by mail-yw0-f46.google.com with SMTP id 32so2920921ywt.33
        for <snortusers@googlegroups.com>; Fri, 18 Nov 2011 00:29:30 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=googlemail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type;
        bh=TtcM0Quqwj8anQI8BFKEzh+fEplq+/h693XBPPgdKrE=;
        b=url1v96gKGm1CafRfpRq1BPvKEDY4FjR5oltxtZ6rtt/r8yNzf8Y/Cn8Os/VcbS26k
         8rRfuNax5Ltj0hHNf1LMvc9IFKNDR+vpW+cIjSS2nmOb4Zx+OvBY9CG0w8sFg7NJIMNp
         aHYKalJv7qWW/QksnFZiLTbKv4PbXS1Wm+H4Q=
MIME-Version: 1.0
Received: by 10.182.45.6 with SMTP id i6mr508111obm.3.1321604969791; Fri, 18
 Nov 2011 00:29:29 -0800 (PST)
Received: by 10.182.15.232 with HTTP; Fri, 18 Nov 2011 00:29:29 -0800 (PST)
In-Reply-To: <7c0464ec-150e-435c-8ddf-439212f14...@b32g2000yqn.googlegroups.com>
References: <7c0464ec-150e-435c-8ddf-439212f14...@b32g2000yqn.googlegroups.com>
Date: Fri, 18 Nov 2011 08:29:29 +0000
Message-ID: <CAM_5znueGiRFBO4VG82NTiqopWYajzrE-Z6SRFaUL_WBCYA...@mail.gmail.com>
Subject: Re: [Snort-Users] Variables
From: Kevin Ross <kevros...@googlemail.com>
To: snortusers@googlegroups.com
Content-Type: multipart/alternative; boundary=f46d0444ea0fc201d604b1fe2211

--f46d0444ea0fc201d604b1fe2211
Content-Type: text/plain; charset=ISO-8859-1

Yeah because you can have things like EXTERNAL_NET = !$HOME_NET which
defines EXTERNAL_NET as anything which isn't defined in your HOME_NET
variable.

On 18 November 2011 00:08, Michael Brown <mike.a.brow...@gmail.com> wrote:

> Can you have variables with - in them like HOME-NET or HOME-NETS?
>
> --
> To post to this group, send email to snortusers@googlegroups.com
>
>
> Please visit http://blog.snort.org for the latest news about Snort!
>

--f46d0444ea0fc201d604b1fe2211
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Yeah because you can have things like EXTERNAL_NET =3D !$HOME_NET which def=
ines EXTERNAL_NET as anything which isn&#39;t defined in your HOME_NET vari=
able.<br><br><div class=3D"gmail_quote">On 18 November 2011 00:08, Michael =
Brown <span dir=3D"ltr">&lt;<a href=3D"mailto:mike.a.brow...@gmail.com">mik=
e.a.brow...@gmail.com</a>&gt;</span> wrote:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex;">Can you have variables with - in them like =
HOME-NET or HOME-NETS?<br>
<span class=3D"HOEnZb"><font color=3D"#888888"><br>
--<br>
To post to this group, send email to <a href=3D"mailto:snortusers@googlegro=
ups.com">snortusers@googlegroups.com</a><br>
<br>
<br>
Please visit <a href=3D"http://blog.snort.org" target=3D"_blank">http://blo=
g.snort.org</a> for the latest news about Snort!<br>
</font></span></blockquote></div><br>

--f46d0444ea0fc201d604b1fe2211--