[Snort-users] rules: react
Maciej Tomasz Szarpak
M.Szarpak at ...137...
Tue Oct 9 02:29:11 EDT 2001
Please refer to Snort > Documentation > Rules > React rule
You need to have at least one content keyword in your rul.
On Tue, 25 Sep 2001, Vsevolod Zaika wrote:
> Is somebody use 'react' in rules?
> I have installed LibNet-1.0.2a, configured and
> maked snort-1.8.1-RELEASE (build 74)
> whith --enable-flexresp.
> i have included in some rules following:
> alert tcp [bla-bla-bla] ( [bla-bla-bla]; react: block,warn; )
> (or simply block)
> (i receive no error messages during snort starting)
> but when this rule ativated nothing except logging happens.
> (no session close, no warning messages to attackers etc.)
> command line options to snort are:
> ./snort -sIDN
> OS: FreeBSD 4.1.1-RELEASE.
> What is wrong?
> Thank you for help.
> WBR, Vsevolod I. Zaika,
> ISS system administrator.
> [VZ666-RIPE] [VIZ1-UANIC]
More information about the Snort-users