[Snort-users] win32 snort (resp + react)
jeff at ...950...
Mon Jul 7 01:20:01 EDT 2003
-----BEGIN PGP SIGNED MESSAGE-----
I'm not sure if Jon was talking about the code I sent out specifically to
the list of people testing the new code.
Thanks for responding in any case Rich.
Let me be 100% clear. Jon, if you are testing the new code, please respond
directly to the list of testers and myself rather than this list.
- --On Sunday, July 6, 2003 13:13 -0600 Rich Adamson <radamson at ...2127...>
>> im attempting 2 simple rules as a test (on win32 port):
>> alert tcp $HOME any -> any 80 (msg: "Port 80"; resp: rst_snd;)
>> alert tcp $HOME any -> any 81 (msg: "Port 81"; react: block;)
>> the first one tells me that resp is a bad keyword.
> The Win32 executable that Jeff sent all of us for testing had a bug
> in it that kept "resp:" from being recognized as a keyword. After he
> corrected that, I also noticed the keyword had no impact (eg, rst_snd
> was not sent).
>> the second actually can have block, warn, msg ... but on an outgoing
>> connection nothing really happens. im expecting snort to kill the
>> connection and not allow a request through (but the laptop still gets the
>> am i missing something?
> Not missing a thing. Jeff was going to debug the code this weekend. If
> his weekend is/was as busy as mine, it will probably be a few days
> before we hear anything.
> This SF.Net email sponsored by: Free pre-built ASP.NET sites including
> Data Reports, E-commerce, Portals, and Forums are available now.
> Download today and enter to win an XBOX or Visual Studio .NET.
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> Snort-users list archive:
http://cerberus.sourcefire.com/~jeff (gpg key available)
Great spirits have always encountered violent opposition from mediocre
- - Albert Einstein
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (Darwin)
-----END PGP SIGNATURE-----
More information about the Snort-users