Logo created with GIMP Filter: 'Xtns' -> 'Script Fu' -:> 'Logos' -> 'Alien Glow' -> 'Script Arguments' { Text: SANCP, Font size (pixels): 150, Font: Sans Bold, Glow color: afc3a8 }

# sancp.conf version 1.6.1+ 

#
# 1 - Define variables to use in subsequent rules - vars are context sensitive ( eth_proto, ip, ip_proto, port )
# 

var ip 8
var icmp 1
var tcp 6
var udp 17
var dns 53

#
# 2 - Define known ports for udp and tcp/ip traffic
# 
# These values will be used to reverse the (source and destination-related values) to change the apparent
# direction of connections which commonly appear 'reverse' that of their commonly presumed direction.
#

known_ports udp dns
known_ports tcp 25, dns, 80, 443

#
# 3 - Define rules 
#
# Rule Format: {PROFILE} {OPTIONS}
#
# Where
# PROFILE contains six fields: (Use the field-keyword 'any' to indicate all possible field values)
#
# <eth_proto.num> <src_ip.dotted[/mask]> <dst_ip.dotted[/mask]> <ip_proto.num> <src_port.num> <dst_port.num> 
# 
# OPTIONS may be any of the following:
#
# realtime <log|pass>, stats <log|pass>, pcap <log|pass|filename|tsfilename|connection>,
# rid <N>, rgid <N>, limit <N>, tcplag <N>, timeout <N>, retro
#
#

ip any any tcp any 443; limit 1500
ip any any udp any any; realtime pass
ip any any icmp any any; realtime pass

#
# Note: comments (/#.*$/), commas, semi-colons, equal-signs, tabs and extra spaces are ignored in configuration files
#

# sancp.conf version 1.6.1+

# sancp.conf version 1.6.2+

 Oct 16, 2007 - Version 1.6.2-candidate.C.5 (released as beta)
 - updated docs/CHANGES
 - updated docs/README

 Oct 09, 2007 - Version 1.6.2-candidate.C.5 

 - added 'nosrc_pktsok' rules option support to force the 'known_ports' direction preference for
 connections which receive no packets* from the assumed source
 - added new output field value for 'reversed' (5 == 'MAYBEREVERESED'); indicates
 when option 'nosrc_pktsok' was applied to force the direction*
 - added default nosrc_pktsok = 0, set to 1 to enable, does not REREVERSE connections which have
 closed with no packets collected from the assumed source, 'reversed' connections
 typically result when the initial packet is dropped by the collection engine,
 or when packets appear to be coming from known_ports (i.e. network scans, or third-party DDOS RESET packets)

 *nosrc_pktsok is not applied to TCP connections whose first packet contained a SYN flag or SYN-ACK flag combination, in which case, the inferred TCP direction is preferred over known_ports 6.


 Sep 30, 2007 - Version 1.6.2-candidate.C.4 (not released, beta)

 - resolve problem not printing known_ports setting in configuration output (i.e. --config)
 - added new output format option 'wildchar=\s'; used by fields sample_src_asc and sample_dst_asc
 sets character to print in place of nonprintable characters, i.e. 'wildchar=.'


 Sep 24, 2007 - Version 1.6.2-candidate.C.3 (released as beta)

 - document additional prelude-related rule options available in docs/README


  Sep 06, 2007 - Version 1.6.2-candidate.C.3-customoutput (not released - to be released as 1.6.2-candidate.C.3 )

 modify apply_rules.cc, build_acl.cc, check_packet.cc, sancp.cc, gvars.h, sancp.h
 - add custom prelude output support to rules for output control; requested by Dean Takemori, forwarded by Sebastian Tricaud
 i.e.
 var trusty 10.0.0.1
 8 trusty any 6 any 22 prelude pass # disable prelude output on matching secure shell connections
 8 any any 6 any 22 prelude log # enable prelude output on matching secure shell connections