[Snort-sigs] Active Response in what version?

Geoff gpoer at ...1983...
Mon Oct 27 16:11:10 EST 2003


Hey Shane,
	It has actually been in there for a while but there are more options now than 
there used to be. Make sure that you complied it in when you built snort:

./configure --enable-flexresp

Good luck and be careful with that stuff :) it will cause some strange problems!

Geoff

Shane Smith wrote:
> Hey Snort Team,
>  
> Reading through the snort manuals, ( 
> http://www.snort.org/docs/writing_rules/chap2.html#tth_sEc2.3.22 ) it 
> appears as active response is available starting in the 2.0.0 version.  
> But, I am getting the error "Unknown keyword 'resp' in rule!".  Did I 
> forget to activate something important, or am I just not running the 
> correct version?  (I'm running 2.0.0 in my test environment)
>  
> Thanks,
> Shane Smith





More information about the Snort-sigs mailing list