Suricata-update - modify.conf and $EXTERNAL_NET

Help
1

Hello all,

I need to replace the $EXTERNAL_NET in several ET rules with $HOME_NET using the modify.conf file and suricata-update.

I’ve tried several variations of this:

re:“alert tcp $EXTERNAL_NET” “tcp $EXTERNAL_NET” “tcp $HOME_NET”

but none of them are working.

We’ve been using this for rule with “any” with no problem for over a year now, however:

re:“alert tcp any” “alert tcp any” “alert tcp $HOME_NET”

How would I go about replacing $EXTERNAL_NET with $HOME_NET?

Please let me know.

Thanks!

2

Try:

re:"alert tcp \\$EXTERNAL_NET" "tcp \\$EXTERNAL_NET" "tcp $HOME_NET"

$ has special meaning in the match side of a regular expression. And for some reason we have to double escape, I think due to compatibility with tools that existed before suricata-update.

3

That did it. I tried a single backslash before, but I didn’t know about the double backslash. Thanks!