Modify.conf question

Hi all (and happy thanksgiving to our US friends),

Currently I am working through rule 2006380. I will need to exclude some ranges and singular dest IPs.
As a result I make my modify.conf line as follows:

2006380 "$HOME_NET any -> any any" "$HOME_NET any -> ![$NAME1,,,] any"

For some reason, after killing suricata, running suricata-update, and restarting suricata I still see alerts with dest ip

No idea why. I could create a whole new rule of course, however that surpasses the idea of having a modify.conf (I believe).

Anyone’s input is highly appreciated (as always),


You will need to escape the $ in the first match as it has special meaning in regular expressions. Try:

2006380 "\\$HOME_NET any -> any any" "$HOME_NET any -> ![$NAME1,,,] any"
1 Like

Thanks so much @ish to show me the light on this Thanksgiving!