[Snort-users] Newbie questions, Snort on NT, stealth mode vs react/flexresp

Dragos Ruiu dr at ...381...
Wed Oct 9 13:43:03 EDT 2002


On October 9, 2002 08:23 pm, Dave Thornburgh wrote:
> John -
>
> Thanks for the file.  In the extracted folder I've got (the NT version),
> there is absolutely NO documentation.
>
> Everyone else:
>
> While John did get me the M to RTF, it is extremely sparse, and doesn't
> begin to address the interaction of flexresp with stealth sniffing.  Is
> anybody out there using it yet?  Or, from another angle, does anybody know
> if it's possible to transmit packets from an interface that has no IP
> address assigned?

Interesting question. If you are using a tap it's not possible AFAIK
Prolbably depends on specific investigation of the "stealth" tap tho.

Check the FAQ. Download the source tarball with docs.

cheers,
--dr

-- 
dr at ...381...   pgp: http://dragos.com/kyxpgp
Advance CanSecWest/03 registration available: http://cansecwest.com
"The question of whether computers can think is like the question
  of whether submarines can swim." --Edsger Wybe Dijkstra 1930-2002





More information about the Snort-users mailing list