[Snort-devel] React with InlineMode

Giacomo Tesio development.comunications at ...2499...
Mon Jun 9 12:12:37 EDT 2008


Hello every body!

I'm working to integrate better sp_react.c with inline mode, since we need
it in IPS mode to match a new italian law.


But I've some question:
- has react:warn ever worked? If not, can I completely drop its code (and
log a warning where found in a rule)
- since block is the only basic option, can I consider the default (if not
given)?
- there is some arcane reason I'm missing for fixing the tcp data size to
1024?
- where should I send the patch?

By looking at the code, I've found some easy bugs I will fix in the patch
too (missing TH_ACK, the proxy modifier not working when a port is given).


I've also open a topic in the forum some days ago, but with no reply:
http://www.snort.org/reg-bin/forums.cgi?forum_id=4&topic_id=6050



Ah... Thanks for your wonderful software! :-D

-- 
Giacomo Tesio
http://www.tesio.it
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20080609/47739452/attachment.html>


More information about the Snort-devel mailing list