[Snort-users] Flexresp2 installation and configuration Problem
mkettler at ...4108...
Tue Dec 23 07:43:01 EST 2003
At 06:53 AM 12/23/2003, RAJNEEL DHOTRE wrote:
>I have download and installed Flexresp2 and libnet. I have also add the
>resp:reset in icmp rules.
Um.. what do you think a resp:reset going to do to an icmp message?
resp:reset ONLY works for TCP.. it does NOT work for icmp, or udp. It can't
work for icmp or udp.. It doesn't even make sense to try.
UDP and ICMP are stateless.. It is impossible to reset (or desynchronize)
the connection, because there is no connection.
In the case of UDP and ICMP, your best bet is icmp_host, but bear in mind
an attacker WILL ignore them.
Disclaimer about reliability:
Resp:reset can be probably evaded by a sophisticated attacker with enough
tries, but icmp_host can be evaded by an amateur... however, it's your only
option for stateless stuff... It is still better than nothing, but
flexresp2 is not replacement for a firewall. Use it as a supplement, but
keep your firewalls properly configured as your first defense.
>ERROR: Unknown config directive: config flexresp2_interface:eth0
>Fatal Error, Quitting..
Did you download a precompiled binary, or source code? the above message
snounds like you're running a version of snort that does not support flexresp2.
More information about the Snort-users