[Snort-users] Flex but no response ....

skill2die4 skill2die4 at ...131...
Tue Jan 15 14:27:06 EST 2002

snort and related utilities version numbers :

libnet.tar.gz (1.0.2a)
libpcap (0.6)
snort -1.8.3 (built 88) [configured option=flexResp]

scenario :
----------- --- pings to --->

rule file ::
alert icmp any ---> any any (msg:"Not allowed";resp:icmp_host;)

snort activation
snort -A full -c flexRESP.rules

a. snort intialization reads -->

    1 snort rules read .... 
    1 option chain linked into 1 chain header
    0 dynamic rules

b. the PING from works and gets back a result from;
   snort only WRITES to the ALERT file

 I tried using the REACT with "TCP && BLOCK , MSG" options and telnet
 from,the connect was refused ... however i didnt got any
 VISIBLE BLOCK MESSAGE from the other side.

Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com

More information about the Snort-users mailing list