[Snort-users] react: block
cc at ...9707...
Fri Jul 25 03:14:04 EDT 2003
Isn't the "react: block;" option supposed to block all further
attempts at sending/receiving information based on the snort rule?
Here's an attempt to block Google's image:
alert tcp any 80 <> any any ( content: "/images/hp"; \
msg: "Blocked Google image" \
The message is displayed in the log but the image still goes
through. Did I misunderstand something rather important regarding
Any help appreciated.
** All information contained in this email is strictly **
** confidential and may be used by the intended receipient **
** only. **
More information about the Snort-users