[Snort-users] Snort on W2k + Flexresp + stealth

Rich Adamson radamson at ...2127...
Thu Jul 10 13:52:29 EDT 2003


> I'm currently running Snort 2.x on a W2K server with 2 NIC and one with 
> IP address 0.0.0.0 on the insecure segment.  Works well.  I'm trying to
> make Flexresp work.  I have put the Libnetnt.dll in my system32 folder 
> but I still have the error PacketSendPacket error. 
> 
> Does the fact that my IP address is at 0.0.0.0 could be the cause of 
> my problem?

The Win32 version of snort has a problem right now with flex resp, and one
of the developers is working on a fix.

Flex resp does work, but it sends packets "only" out the first interface 
displayed when you do "snort -W". If that interface is not your sensor
interface, flex resp will respond with the PacketSendPacket error noted
above.

Hopefully we're within a week or two from correcting the issue, but no
promises.

Rich






More information about the Snort-users mailing list