[Snort-users] Flex Response

Dilli Rajesh Kumar drajesh at ...3758...
Wed Oct 10 07:03:11 EDT 2001


This is the rule i've set up:
alert tcp any any <> any any (content-list: "adults"; msg:"not for children";
$RESP_ALL)

and i 've defined RESP_ALL in my snort.conf as

var  RESP_ALL  resp:rst_all;

DRajesh












agetchel at ...1525... wrote:

> Hi DRajesh,
>         I take it it's erroring out in the initialization process?  Can you
> post the rules which it's having trouble with?
>
> Thanks,
> Abe
>
> Abe L. Getchell - Security Engineer
> Division of System Support Services
> Kentucky Department of Education
> Voice   502-564-2020 ext. 225
> E-mail  agetchel at ...1525...
> Web     http://www.kde.state.ky.us/
>
> > -----Original Message-----
> > From: Dilli Rajesh Kumar [mailto:drajesh at ...3758...]
> > Sent: Wednesday, October 10, 2001 8:55 AM
> > To: agetchel at ...1525...
> > Cc: snort-users at lists.sourceforge.net
> > Subject: Re: [Snort-users] Flex Response
> >
> >
> > Hi,
> >               I'm sorry.--enable-flexresp is what i tried with
> > configure.I've installed libnet also and my snort configure is able to
> > detect it too..Even then i get  resp and react as unknown keywords.
> >
> > DRajesh
> >
> >
> > agetchel at ...1525... wrote:
> >
> > > Hi DRajesh,
> > >         Try '--enable-flexresp' when doing a ./configure.
> > Leave off the
> > > 'onse' on the end of 'response'.
> > >
> > > Thanks,
> > > Abe
> > >
> > > Abe L. Getchell - Security Engineer
> > > Division of System Support Services
> > > Kentucky Department of Education
> > > Voice   502-564-2020 ext. 225
> > > E-mail  agetchel at ...1525...
> > > Web     http://www.kde.state.ky.us/
> > >
> > > > -----Original Message-----
> > > > From: Dilli Rajesh Kumar [mailto:drajesh at ...3758...]
> > > > Sent: Wednesday, October 10, 2001 7:38 AM
> > > > To: snort-users at lists.sourceforge.net
> > > > Subject: [Snort-users] Flex Response
> > > >
> > > >
> > > > Hi,
> > > >               I tried to use the Flex Response  included in
> > > > the snort by
> > > > trying resp and react .I configured my snort with
> > > > --enable-flexresponse
> > > > .Eventhough when i try to start snort i get error messages
> > > > like unknown
> > > > keywords "resp" and "react".I'm using snort version 1.8.1.
> > > > Can anybody help
> > > > me out in this plz
> > > >
> > > > DRajesh
> > > >
> > > >
> > > > _______________________________________________
> > > > Snort-users mailing list
> > > > Snort-users at lists.sourceforge.net
> > > > Go to this URL to change user options or unsubscribe:
> > > > https://lists.sourceforge.net/lists/listinfo/snort-users
> > > > Snort-users list archive:
> > > > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> > > >
> >





More information about the Snort-users mailing list