[Snort-users] Discard Packets
alambert at ...387...
Thu Oct 26 14:41:59 EDT 2000
> I`m a snort user and configure it to reset connections with the
> cotent ".vbs", but it don't "block" the mails with it content....I
> continue receiving the mail with the vbs file...the mail server send
> the mail per 3 or 5 days(probably because snort reset the connection)
> with the #$%*& vbs file...Can I use snort to discard the packets with
> this content(editing the snort source code)??????Or anybody has other
> idea to block or reject it?????
> Elton Ramos Carvalho Brasil
Yeah, I think you're right; snort reset's the connection, so the
mail doesn't get sent, and the mail server queue's it to try again later.
Best bet (IMHO), is to configure your mailserver to /dev/null *.vbs
More information about the Snort-users