[Snort-users] Flexresp

Bill Shaffer billshaffer at ...4566...
Wed Jan 16 12:15:55 EST 2002


To elaborate on what Chris stated yes Flexrep gives you the ability to
send RST packets to the hostile computer and to your stations but this
is not fully functioning with win32, this is still in beta. The other
problem that has been stated is that while the crafted packet is being
constructed your computer (if on a fast network) can reply to the
hostile packet before snort can send the RST packet. 

Anyone can please correct me if I said that wrong...

Hope this helps,
Bill

-----Original Message-----
From: Chris Green [mailto:cmg at ...671...] 
Sent: Wednesday, January 16, 2002 11:39 AM
To: Sean T. Ballard
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Flexresp

"Sean T. Ballard" <stballard at ...4587...> writes:

> Does anyone have a white paper on Flexresp? I tried locating more
> info on it at snort.org but found nothing conclusive.  Now flexresp
> is the ability accept or deny access based on the rules file
> correct? any info would be appreciated.

It's the ability to send disruptive packets to the hosts involved.
Since snort isn't in the way of the connections, its not accepting or
denying access.

It's a good try but not something to rely on 100%.
-- 
Chris Green <cmg at ...671...>
Laugh and the world laughs with you, snore and you sleep alone.

_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users




More information about the Snort-users mailing list