[Snort-users] rules: react

Maciej Tomasz Szarpak M.Szarpak at ...137...
Tue Oct 9 02:29:11 EDT 2001


Hi,

Please refer to Snort > Documentation > Rules > React rule
on www.snort.org

You need to have at least one content keyword in your rul.

Enjoy it,

Maciek.


On Tue, 25 Sep 2001, Vsevolod Zaika wrote:

>
> Is somebody use 'react' in rules?
> I have installed LibNet-1.0.2a, configured and
> maked snort-1.8.1-RELEASE (build 74)
> whith --enable-flexresp.
>
> i have included in some rules following:
>
> alert tcp [bla-bla-bla] ( [bla-bla-bla]; react: block,warn; )
>                                            (or simply block)
>
> (i receive no error messages during snort starting)
>
> but when this rule ativated nothing except logging happens.
> (no session close, no warning messages to attackers etc.)
>
> command line options to snort are:
>
> ./snort -sIDN
> B
> OS: FreeBSD 4.1.1-RELEASE.
>
> What is wrong?
>
> Thank you for help.
>
>
> --
> WBR, Vsevolod I. Zaika,
> ISS system administrator.
>
> [VZ666-RIPE] [VIZ1-UANIC]





More information about the Snort-users mailing list