[Snort-users] React: block

Dirk Geschke dirk at ...10648...
Mon Jun 25 17:11:02 EDT 2007


Hi Keith,

> > > alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET
> > any (msg:"PORN anal
> > > sex"; content:"anal sex"; nocase; flow:to_client,established;
> > > classtype:kickass-porn; sid:1317; rev:5; react:
> > > block;)

are you sure that the rule is correct? Looks for me like there is
a space between the colon and block. I think this is something the
parser does not like...

Best regards




More information about the Snort-users mailing list