[Snort-users] react: block

Edmund cc at ...9707...
Fri Jul 25 03:14:04 EDT 2003


Isn't the "react: block;" option supposed to block all further
attempts at sending/receiving information based on the snort rule?

Here's an attempt to block Google's image:

alert tcp any 80 <> any any ( content: "/images/hp"; \
                              msg: "Blocked Google image" \
                              react: block;)

The message is displayed in the log but the image still goes
through.  Did I misunderstand something rather important regarding
this feature?

Any help appreciated.

** All information contained in this email is strictly     **
** confidential and may be used by the intended receipient **
** only.                                                   **

More information about the Snort-users mailing list