[Snort-users] More explanation needed in Snort User Manual for "resp:"?

Chris Green cmg at ...1935...
Thu Nov 6 13:31:05 EST 2003


Jason Haar <Jason.Haar at ...294...> writes:

> I've looked at flexresp2, and it allows you to explicitly configure which
> interface RESET packets are set through - which is almost there. But this
> still seems like a bug to me, as I can't think of a reason why you would
> ever want the packet to leave through anything other than the interface it
> was seen on! [well, except one: TAPs - but that's pretty special case]
>
> Am I missing something here?

You have the problem space down. Asynchronous routing

-i any or -i bond0  will throw away almost any info you could.
-- 
Chris Green <cmg at ...1935...>
This is my signature. There are many like it but this one is mine.




More information about the Snort-users mailing list