[Snort-devel] React with InlineMode

Giacomo Tesio development.comunications at ...2499...
Mon Jun 9 12:12:37 EDT 2008

Hello every body!

I'm working to integrate better sp_react.c with inline mode, since we need
it in IPS mode to match a new italian law.

But I've some question:
- has react:warn ever worked? If not, can I completely drop its code (and
log a warning where found in a rule)
- since block is the only basic option, can I consider the default (if not
- there is some arcane reason I'm missing for fixing the tcp data size to
- where should I send the patch?

By looking at the code, I've found some easy bugs I will fix in the patch
too (missing TH_ACK, the proxy modifier not working when a port is given).

I've also open a topic in the forum some days ago, but with no reply:

Ah... Thanks for your wonderful software! :-D

Giacomo Tesio
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20080609/47739452/attachment.html>

More information about the Snort-devel mailing list