Following the IP variables come three port variables:
var HTTP_PORTS 80
var SHELLCODE_PORTS !80
var ORACLE_PORTS 1521
The defaults are acceptable, but it makes sense to include ports relevant to the environment. For example, if the monitored network offers Web servers on port 8000, 8080 and 8888, add those to the HTTP_PORTS variable.
Snort: Understanding the configuration file
Introduction: Upgrade to Snort 2.6.1.2
The snort.conf file
Defining IP ranges of interest
Defining ports of interest
Core preprocessors
Non-dynamic preprocessors
Conclusion
About the author
Richard Bejtlich is founder of TaoSecurity, author of several books on network security monitoring, including Extrusion Detection: Security Monitoring for Internal Intrusions, and operator of the TaoSecurity blog.
