[Snort-users] snort with react keyword not sending msg to browser

RMS, Admin Admin.RMS at ...14841...
Tue Apr 27 07:26:40 EDT 2010


I'm using snort inline, and i try to set up a msg with the react keyword for users (ip) which trigger the following alert :

alert tcp any any <> $EXTERNAL_NET 80 (content:"GET"; \
msg:"Notforchildren!";sid:111000101;react:block, msg;)

The alert is seen in the snort log, but not in the user's browser.
(I suppose that the content of the msg send to the browser is "Notforchildren!")

Then, I'v tried with

alert tcp any any <> $EXTERNAL_NET 80 (content:"GET"; \
msg:"Notforchildren!";sid:111000101;react:block, msg, proxy 8080;)

I don't understand the modifier "proxy". It is a local port which send the msg to user or is it the web proxy ?

And the following error occurs when starting snort :

ERROR: /etc/snort_inline/rules/local.rules(7): invalid react modifier: proxy 8080

Question : How snort send message to browser ? Does it with any Os or browser (IE, Firefox...) ?

Thanks in advance,


Avant d'imprimer ce message, pensez ? la protection de notre environnement.

This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20100427/75a2870d/attachment.html>

More information about the Snort-users mailing list