[Snort-users] Flexresp2 installation and configuration Problem

Matt Kettler mkettler at ...4108...
Tue Dec 23 07:43:01 EST 2003


At 06:53 AM 12/23/2003, RAJNEEL DHOTRE wrote:
>I have download and installed Flexresp2 and libnet.  I have also add the 
>resp:reset in icmp rules.

Um.. what do you think a resp:reset going to do to an icmp message?

resp:reset ONLY works for TCP.. it does NOT work for icmp, or udp. It can't 
work for icmp or udp.. It doesn't even make sense to try.

UDP and ICMP are stateless.. It is impossible to reset (or desynchronize) 
the connection, because there is no connection.

In the case of UDP and ICMP, your best bet is icmp_host, but bear in mind 
an attacker WILL ignore them.

Disclaimer about reliability:
Resp:reset can be probably evaded by a sophisticated attacker with enough 
tries, but icmp_host can be evaded by an amateur... however, it's your only 
option for stateless stuff... It is still better than nothing, but 
flexresp2 is not replacement for a firewall. Use it as a supplement, but 
keep your firewalls properly configured as your first defense.


>ERROR: Unknown config directive: config flexresp2_interface:eth0
>Fatal Error, Quitting..

Did you download a precompiled binary, or source code? the above message 
snounds like you're running a version of snort that does not support flexresp2.





More information about the Snort-users mailing list