[Snort-sigs] Resp Keyword in Windows XP!!

Matt Kettler mkettler at ...189...
Tue Jul 29 09:07:06 EDT 2003


At 04:18 AM 7/29/2003 -0400, jthomas at ...1718... wrote:
>Hello,
>
>   I was wondering if you could tell me why I get a Warning: Unkown
>keyword 'resp' in rule when I activate Snort?  I am running Snort on a 
>Windows
>XP machine for a school project.  We were asked to right a rule that would
>detect inbound Telnet and would reset both the sender and the receiver.  I am
>using the command line version of Snort...I believe it is version 2.0.  Here
>is the resp section of the rule that is saved in the local.rules file: (resp:
>rst_all; msg:"Inbound Telnet Attempt";).  Hopefully you can help me!!
>
>Thanks For Your Time,

The resp keyword requires a build of snort that supports the optional 
flexresp feature. At present, flexresp does not work on Windows versions, 
but I did hear that someone was working on fixing it.






More information about the Snort-sigs mailing list