[Snort-users] Error on new Rule

Snort Snort at ...13151...
Wed Mar 16 07:14:26 EST 2005


For UDP you use ICMP and TCP uses resets

 

The readme.flexresp and readme.inline might help clear a few things up,
along with the online manual

 

http://www.snort.org/docs/snort_htmanuals/htmanual_232/node7.html

 

 

Michael Brown

  _____  

From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Ron
Jenkins
Posted At: Wednesday, March 16, 2005 9:12 AM
Posted To: Snort
Conversation: Error on new Rule
Subject: [Snort-users] Error on new Rule
  

On the below new rule, I added the react:block for the FlexResp feature
of snort.  

 

alert udp $HOME_NET any -> $EXTERNAL_NET 41170 (msg:"P2P Manolito Search
Query"; content:"|01 02 00 14|"; offset:16; depth:4;
reference:url,www.blubster.com; reference:url,openlito.sourceforge.net;
react:block; classtype:policy-violation; sid:3459; rev:2;)

 

I get the below error:

 

ERROR: Line /etc/snort/local.rules(28): TCP Options on non-TCP rule

Fatal Error, Quitting..

 

Does FlexResp only work on TCP rules and not UDP?

 

Thanks...

 

 

Ron Jenkins (MCNE, CNE6, MCP, CCNA, CCEA) 
Senior Architect 
Data Integrity, LLC 
"We Integrate People with Solutions" 
1724 Dallas Drive 
Suite 11 
Baton Rouge, La 70806 
Office. 225.927.8030 
Fax. 225.927.8033 
Cell225.931.1632 
Email. rjenkins at ...12829... 
Web. www.dibr.net 

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20050316/1f759b58/attachment.html>


More information about the Snort-users mailing list