[Snort-sigs] Resp Keyword in Windows XP!!
mkettler at ...189...
Tue Jul 29 09:07:06 EDT 2003
At 04:18 AM 7/29/2003 -0400, jthomas at ...1718... wrote:
> I was wondering if you could tell me why I get a Warning: Unkown
>keyword 'resp' in rule when I activate Snort? I am running Snort on a
>XP machine for a school project. We were asked to right a rule that would
>detect inbound Telnet and would reset both the sender and the receiver. I am
>using the command line version of Snort...I believe it is version 2.0. Here
>is the resp section of the rule that is saved in the local.rules file: (resp:
>rst_all; msg:"Inbound Telnet Attempt";). Hopefully you can help me!!
>Thanks For Your Time,
The resp keyword requires a build of snort that supports the optional
flexresp feature. At present, flexresp does not work on Windows versions,
but I did hear that someone was working on fixing it.
More information about the Snort-sigs