How to add wildcards to snort rule ip address?

[nixor01]

Is it possible to add wildcards or something that would function like them to snort IP address?


For example:


If I'd like to detect source-ip of: 192.168.*.9


where the third octet can be anything in range 1-255, but the fourth octet has to be exactly '9'.


Thank you.

[daredent]

This was answered here:
http://security.stackexchange.com/qu...ule-ip-address