[Snort-users] flexresp?

permalink · #1 (**permalink**) 12-17-2004

This is a multi-part message in MIME format.

------_=_NextPart_001_01C4E3C7.0C21C731
Content-Type: text/plain;
charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable

Hi all,

=20

I just updated to the latest Snort (2.3.0RC2) and compiled it with the
flexresp option. It compiled fine and accepts and understands "resp"
rules, however during testing I have created rules using "resp: rst_all"
and they don't work. I see my test criteria is found in the alert logs
but it does not appear to reset the session. This used to work for me in
the past.=20

=20

Afterward I noticed my sniffing interface did not have an IP assigned,
so I assigned one and did the test again. That still did not help.

=20

I'd like to mess around with sending TCP RSTs when a rule is triggered
or some other way of killing a session when a rule is met. Is Flexresp
the option I should be using or are there better features now? Just
wondering if I should be spending time on flexresp or looking at
something better.=20

=20

I looked at the new "inline" features but not sure if this is an
alternative?

=20

=20

Thanks

=20

------_=_NextPart_001_01C4E3C7.0C21C731
Content-Type: text/html;
charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable

<html xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns=3D"http://www.w3.org/TR/REC-html40">

<head>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">

<meta name=3DGenerator content=3D"Microsoft Word 11 (filtered medium)">
<style>

</style>

</head>

<body lang=3DEN-US link=3Dblue vlink=3Dpurple>

<div class=3DSection1>

Hi all,<o:p></o:p>

<o:p> </o:p>

I just updated to the latest Snort (2.3.0RC2) and =
compiled
it with the flexresp option. It compiled fine and accepts and =
understands “resp”
rules, however during testing I have created rules using “resp: =
rst_all”
and they don’t work. I see my test criteria is found in the alert =
logs but
it does not appear to reset the session. This used to work for me in the =
past. <o:p></o:p>

<o:p> </o:p>

Afterward I noticed my sniffing interface did not =
have an IP
assigned, so I assigned one and did the test again. That still did not =
help.<o:p></o:p>

<o:p> </o:p>

I’d like to mess around with sending TCP RSTs =
when a
rule is triggered or some other way of killing a session when a rule is =
met. Is
Flexresp the option I should be using or are there better features now? =
Just
wondering if I should be spending time on flexresp or looking at =
something
better. <o:p></o:p>

<o:p> </o:p>

I looked at the new “inline” features but =
not
sure if this is an alternative?<o:p></o:p>

<o:p> </o:p>

<o:p> </o:p>

Thanks<o:p></o:p>

<o:p> </o:p>

</div>

</body>

</html>

------_=_NextPart_001_01C4E3C7.0C21C731--

-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode