[Snort-users] Discard Packets

A.L.Lambert alambert at ...387...
Thu Oct 26 14:41:59 EDT 2000

>    Hi...
>        I`m a snort user and configure it to reset connections with the
> cotent ".vbs", but it don't "block" the mails with it content....I
> continue receiving the mail with the vbs file...the mail server send
> the mail per 3 or 5 days(probably because snort reset the connection)
> with the #$%*& vbs file...Can I use snort to discard the packets with
> this content(editing the snort source code)??????Or anybody has other
> idea to block or reject it?????
>         Tks
> Elton Ramos Carvalho Brasil

	Yeah, I think you're right; snort reset's the connection, so the
mail doesn't get sent, and the mail server queue's it to try again later.  
Best bet (IMHO), is to configure your mailserver to /dev/null *.vbs
attachments.  Cheers!

-- A.L.Lambert

More information about the Snort-users mailing list