[Snort-users] FlexResp support (Bug with "-o" option)

Jason Haar Jason.Haar at ...294...
Mon Sep 4 23:59:55 EDT 2000


Says it all really. I was successfully using " resp: rst_all" on a rule,
then decided I wanted to ignore ICMP packets from a monitor box we run. So I
put in a "pass ICMP..." rule and set snort to run with the "-o" option. Well
the moment I did that, the FlexResp component stopped working :-(

Is this a bug, and anyhow, how can I set up snort with "pass" rules besides
the "-o" option? Or is it that if you want to ignore certain packets, you
_have_ to use "-o"? I can't get "pass" to be seen any other way...

-- 
Cheers

Jason Haar

Unix/Network Specialist, Trimble NZ
Phone: +64 3 9635 377 Fax: +64 3 9635 417
               



More information about the Snort-users mailing list