Search code examples
snort

How to make inline comments in snort rule file?


One of my assignments requires me to provide inline comments for the snort rule.

It should look something like:

alert \ (some comment initiator here) comment

any \ (explanation)
any \ (explanation)

and so on...

How would I make inline comments with Snort?


Solution

  • You might want to have a look at the Snort manual. Comments are created in the configuration and rules files with the pound sign, which is pretty typical of UNIX type things:

     alert tcp any any -> any 0 (sid:1000000;msg:"Packet to port zero.";) # Example rule with comment