same_local_net_is_spoof : bool
If true (default = F), it should be considered a spoofing attack if a connection has the same local net for source and destination.
Note: This variable isconst
, so may only be changed viaredef
.
allow_spoof_services : set[port]
The services in this set are not counted as spoofed even if they pass the test fromsame_local_net_is_spoof
.
Note: This variable isconst
, so may only be changed viaredef
.
allow_pairs : set[addr, addr]
Connections between these (source address, destination address) pairs are never marked as “hot”.
Note: This variable isconst
, so may only be changed viaredef
.
allow_16_net_pairs : set[addr, addr]
Connections between these (/16 network, /32 destination host) pairs are never marked as “hot”.
Note: This variable isconst
, so may only be changed viaredef
.
hot_srcs : table[addr] of string
Connections from any of these sources are automatically marked “hot” with the associated message in the table.
Note: This variable isconst
, so may only be changed viaredef
.
hot_dsts : table[addr] of string
Connections to any of these destinations are automatically marked “hot” with the associated message in the table.
Note: This variable isconst
, so may only be changed viaredef
.
hot_src_24nets : table[addr] of string
Connections from any of these source /24 nets are automatically marked “hot” with the associated message in the table.
Note: This variable isconst
, so may only be changed viaredef
.
hot_dst_24nets : table[addr] of string
Connections to any of these destination /24 nets are automatically marked “hot” with the associated message in the table.
Note: This variable isconst
, so may only be changed viaredef
.
allow_services : set[port]
Connections to this set of services are never marked “hot” (based on port number).
Note: This variable isconst
, so may only be changed viaredef
.
allow_services_to : set[addr, port]
Connections to the specified host and port are never marked “hot”.
Note: This variable isconst
, so may only be changed viaredef
.
allow_service_pairs : set[addr, addr, port]
Connections from the first address to the second on the specified destination port are never marked “hot”.
Note: This variable isconst
, so may only be changed viaredef
.
flag_successful_service : table[port] of string
Successful connections to any of the specified ports are flagged with the accompanying message. Examples are popular backdoor ports.
Note: This variable isconst
, so may only be changed viaredef
.
flag_successful_inbound_service : table[port] of string
Incoming connections to the specified ports are flagged with the accompanying message. This is similar to , but may be used when the port gives to many false positives for outgoing connections.
Note: This variable isconst
, so may only be changed viaredef
.
terminate_successful_inbound_service : table[port] of string
Connections to this port, if previously flagged byflag_successful_service
orflag_incoming_service
are terminated.
Note: This variable isconst
, so may only be changed viaredef
.
flag_rejected_service : table[port] of string
Failed connection attempts to the specified ports are marked as “hot”.
Note: This variable isconst
, so may only be changed viaredef
.