[Snort-devel] Layer2resets functionality in snort 2.9

snort user snort.user at ...2499...
Mon Oct 3 12:21:44 EDT 2011


Found the answer. This functionality is handled using the DAQ inject API.

On Mon, Oct 3, 2011 at 10:15 AM, snort user <snort.user at ...2499...> wrote:
> Hi all -
>
> layer2resets configuration option is currently obsolete. Is this
> capability still present in some other way? How does snort craft a TCP
> RST segment including the layer 2 headers and send it directly to the
> interface instead of routing the TCP RST via the IPSs network stack ?
> I am looking at active.c and encode.c etc but if someone could throw
> some light on the basic approach it may be really helpful.
>
> Thanks in advance for your help.
>




More information about the Snort-devel mailing list