[Snort-users] FlexResp not working.....

Uwe Kersten uwe_kersten at ...1820...
Fri Apr 13 19:16:13 EDT 2001


Hi all,

I have compiled Snort with --enable-flexresp on my SuSE 7 box, did fine,
I have compiled Libnet, worked fine, I have tested Libnet, it works. I wrote 
a rule with resp:rst_all; in it, a rule out of scan-lib. It is a rule about 
nmap Xmas scan. I did the scan from a remote machine, the alert file went 
full, so did the portscan log file, but the connection was not cancelled. No 
idea what is going wrong, I know FlexResp is alpha, but maybe there is 
someone out there with some idea.

regards
Uwe
-- 
-------------------------------------------------------
                     Uwe Kersten
           E-Mail: uwe.kersten at ...1821...
                   PGP: 87A5676F
           Keyserver: wwwkeys.de.pgp.net
-------------------------------------------------------




More information about the Snort-users mailing list