Re: [Snort-users] How does a reject rule work?

--===============0277941676==
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature";
boundary="=-3L12KaCOr5DgbOVwtR7Y"


--=-3L12KaCOr5DgbOVwtR7Y
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

Read RFC 792 to understand the ICMP Destination Unreachable Message.
"bahamin" not talking about ICMP ports its talking about the messages
sent by hosts using ICMP to tell the sender of something that is not
"reachable" on the recipients computer (such as a port).

One place to find the RFC:

ftp://ftp.rfc-editor.org/in-notes/rfc792.txt

On Tue, 2008-04-29 at 09:02 -0400, Todd Wease wrote:
> You're not going to get 'Destination port unreachable' with ICMP packets
> (they address no port). Try with UDP or TCP packets and rule.
>=20
>=20
> bahamin takhtaei wrote:
> > Hi,
> >=20
> > I wrote an icmp rule with "reject" action and
> > test it by echo request packets (ping), but
> > I didn't catch any "Destination port unreachable"
> > message on the test system. It seems that my
> > "reject" rule works as a "drop" rule only! Now
> > please tell me What do I to fix this problem?
> >=20
> >=20
> > Thanks,
> > Bahamin
> >=20
> > -----------------------------------------------------------------------=
-
> > Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try
> > it now.
> > <http://us.rd.yahoo.com/evt=3D51733/*...om/;_ylt=3DAh=
u06i62sR8HDtDypao8Wcj9tAcJ
> >>
> >=20
> >=20
> > -----------------------------------------------------------------------=
-
> >=20
> > -----------------------------------------------------------------------=
--
> > This SF.net email is sponsored by the 2008 JavaOne(SM) Conference=20
> > Don't miss this year's exciting event. There's still time to save $100.=
=20
> > Use priority code J8TL2D2.=20
> > http://ad.doubleclick.net/clk;198757...java.sun.com/=
javaone
> >=20
> >=20
> > -----------------------------------------------------------------------=
-
> >=20
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users@lists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/...fo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.p...=3Dsnort-users
>=20
>=20
> -------------------------------------------------------------------------
> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference=20
> Don't miss this year's exciting event. There's still time to save $100.=20
> Use priority code J8TL2D2.=20
> http://ad.doubleclick.net/clk;198757...va.sun.com/ja=
vaone
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/...fo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.p...=3Dsnort-users
--=20
C. Philip Wood, Int. D. =
=20
Senior Member of the Internet
Los Alamos National Laboratory
Key fingerprint: 2BB7 A990 44F5 EF4B 4E35 8635 1205 97D3 F6D8 7F39
E-mail: cpw@lanl.gov, cornett@arpa.net
Phone: 510 667-2598

--=-3L12KaCOr5DgbOVwtR7Y
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQBIFzeiEgWX0/bYfzkRAgMSAJ9G11or6EhVflNBRsl98zGyZc0d/ACePLua
KQ5vdcmPnPLW86lapCjPL3c=
=mN8O
-----END PGP SIGNATURE-----

--=-3L12KaCOr5DgbOVwtR7Y--



--===============0277941676==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757...un.com/javaone
--===============0277941676==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users
--===============0277941676==--