Port Variables and Port Lists

Portlists supports the declaration and lookup of ports and the representation of lists and ranges of ports. Variables, ranges, or lists may all be negated with '!'. Also, 'any' will specify any ports, but '!any' is not allowed. Valid port ranges are from 0 to 65535.

Lists of ports must be enclosed in brackets and port ranges may be specified with a ':', such as in:

     
    [10:50,888:900]

Port variables should be specified using 'portvar'. The use of 'var' to declare a port variable will be deprecated in a future release. For backwards compatibility, a 'var' can still be used to declare a port variable, provided the variable name either ends with '_PORT' or begins with 'PORT_'.

The following examples demonstrate several valid usages of both port variables and port lists.

     
    portvar EXAMPLE1 80

    var EXAMPLE2_PORT [80:90]

    var PORT_EXAMPLE2 [1]

    portvar EXAMPLE3 any

    portvar EXAMPLE4 [!70:90]

    portvar EXAMPLE5 [80,91:95,100:200]

    alert tcp any $EXAMPLE1 -> any $EXAMPLE2_PORT (msg:"Example"; sid:1;)

    alert tcp any $PORT_EXAMPLE2 -> any any (msg:"Example"; sid:2;)

    alert tcp any 90 -> any [100:1000,9999:20000] (msg:"Example"; sid:3;)

Several invalid examples of port variables and port lists are demonstrated below:

Use of !any:

     
    portvar EXAMPLE5 !any
    var EXAMPLE5 !any

Logical contradictions:

     
    portvar EXAMPLE6 [80,!80]

Ports out of range:

     
    portvar EXAMPLE7 [65536]

Incorrect declaration and use of a port variable:

     
    var EXAMPLE8 80 
    alert tcp any $EXAMPLE8 -> any any (msg:"Example"; sid:4;)

Port variable used as an IP:

     
    alert tcp $EXAMPLE1 any -> any any (msg:"Example"; sid:5;)