[Snort-sigs] Active Response in what version?

Matt Kettler mkettler at ...189...
Mon Oct 27 16:30:26 EST 2003


At 06:02 PM 10/27/2003, Shane Smith wrote:
>Reading through the snort manuals, ( 
><http://www.snort.org/docs/writing_rules/chap2.html#tth_sEc2.3.22>http://www.snort.org/docs/writing_rules/chap2.html#tth_sEc2.3.22 
>) it appears as active response is available starting in the 2.0.0 
>version.  But, I am getting the error "Unknown keyword 'resp' in 
>rule!".  Did I forget to activate something important, or am I just not 
>running the correct version?  (I'm running 2.0.0 in my test environment)


When you built snort did you ./configure with --enable-flexresp ?

It's a bit unclear to me right now if you need flexresp v2 for this 
functionality or not.. if you do, flexresp2 is downloadable at:
http://cerberus.sourcefire.com/~jeff/archives/snort/sp_respond2/  (linked 
from www.snort.org main page)







More information about the Snort-sigs mailing list