[Snort-users] react: block

cc cc at ...9707...
Fri Jul 25 18:20:05 EDT 2003

Matt Kettler wrote:

> Heh, "react: block" basically causes snort to use flexresp to try to
> reset the connection.
> Of course, if the transfer consists only of one packet, resetting the
> connection won't matter.
> Also in the case of very small http'ed images and snort running stream4,
> you won't likely try to issue a reset until the image is done anyway.

Oh darn.  I was hoping to also use snort as a wannabe-proxy :).

Seriously, my knowledge in this is still shallow so there's still ways
for me to understand all this.

Thanks for the info, Matt!


** All information contained in this email is strictly     **
** confidential and may be used by the intended receipient **
** only.                                                   **

More information about the Snort-users mailing list