[Snort-sigs] RE: RESP error

JOHNSON DAVID R david.johnson at ...1990...
Thu Oct 30 09:26:36 EST 2003


>  -----Original Message-----
> From: 	JOHNSON DAVID R  
> Sent:	Tuesday, October 28, 2003 4:07 PM
> To:	'snort-sigs at lists.sourceforge.net'
> Subject:	RESP error 
> 
> Warning: /etc/snort/rules/icmp.rules(36) => Unknown keyword 'resp' in
> rule!
> 
> this is the output i get when i insert the resp keyword into a rule. 
> Here is the rule;
> 
> 
> #drop ICMP packets associated with CyberKit 2.2 Windows
> #
> #
> #
> alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING CyberKit 2.2
> Windows"; content:"|aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa|";itype:8;depth:32;
> reference:arachnids,154; sid:483;  classtype:misc-activity; rev:2; resp:
> rst_snd;)
> 
> 
> Where am i going wrong, i followed the syntax in the man.
> Please help.
> 
> David Johnson | Network Administrator |
> Hampton University | Hampton, VA | 23669 |
> office 757.728.6528 | fax 757.727.5438
> mailto:davidr.johnson at ...1990...
> 




More information about the Snort-sigs mailing list