[Snort-users] Resp and React keywords don't work?

Sheahan, Paul (PCLN-NW) Paul.Sheahan at ...2218...
Thu Mar 28 09:20:05 EST 2002

I downloaded and compiled "snort-1.8.4.tar.gz". Is this the wrong one? I
don't recall seeing a "flexresp" file. I'l take another look around.....


Paul Sheahan
Manager of Information Security
paul.sheahan at ...2218...

-----Original Message-----
From: Bill McCarty [mailto:bmccarty at ...5196...]
Sent: Wednesday, March 27, 2002 9:26 PM
To: Sheahan, Paul (PCLN-NW)
Subject: Re: [Snort-users] Resp and React keywords don't work?

Hi Paul,

Did you compile Snort or download a binary package?

If you compiled it yourself, Erek's pointer to the FAQ is appropriate and 
helpful. If not, I suggest that you check whether you downloaded a version 
of Snort that includes support for resp and react. Such versions can be 
identified by the presence of "flexresp" in the file name.


--On Wednesday, March 27, 2002 8:13 PM -0500 "Sheahan, Paul (PCLN-NW)" 
<Paul.Sheahan at ...2218...> wrote:

> Just upgraded to Snort 1.8.4 and I'm running on RH Linux 7.0.
> I noticed the new keywords resp and react, but so far when I've tried
> them, I get an error such as:
> "ERROR: /etc/snort/test.rules(10) => Unknown keyword "resp" in rule!"
> Can someone tell me what I'm doing wrong? Every other keyword I tried
> seemed to work fine.
> Thanks!
> Paul Sheahan
> Manager of Information Security
> Priceline.com
> paul.sheahan at ...2218...
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

Bill McCarty, Ph.D.
Associate Professor of Web & Information Technology
School of Business and Management
Azusa Pacific University

More information about the Snort-users mailing list