Variable Modifiers

Snort - the de facto standard for intrusion detection/prevention

the de facto standard in IPS

Search Site

Search Rules

Account

email
password

not registered?

user preferences

Next: Limitations Up: Variables Previous: Port Variables and Port Contents

Variable Modifiers

Rule variable names can be modified in several ways. You can define meta-variables using the $ operator. These can be used with the variable modifier operators ? and -, as described in the following table:

Variable Syntax Description

var Defines a meta-variable.

$(var) or $var Replaces with the contents of variable var.

$(var:-default) Replaces the contents of the variable var with ``default'' if var is undefined.

$(var:?message) Replaces with the contents of variable var or prints out the error message and exits.

See Figure 2.2 for an example of advanced variable usage in action.

**Figure 2.2:** Figure Advanced Variable Usage Example
$\begin{figure}\begin{verbatim}ipvar MY_NET 192.168.1.0/24 log tcp any any -> $(MY_NET:?MY_NET is undefined!) 23\end{verbatim} \par\end{figure}$

Steven Sturges 2008-04-01