[Snort-users] snort react action

Al Lewis (allewi) allewi at ...589...
Wed Apr 6 10:47:33 EDT 2016


Hello,

	What version of snort are you using? 
	What rule are you using?
	What command are you using to start snort?
	Do you have a config file you can share?

Need a little more information sorry.

Albert Lewis
QA Software Engineer
SOURCEfire, Inc. now part of Cisco
9780 Patuxent Woods Drive
Columbia, MD 21046 
Phone: (office) 443.430.7112
Email: allewi at ...589... 


-----Original Message-----
From: free [mailto:free.aaa at ...11827...] 
Sent: Wednesday, April 06, 2016 3:28 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] snort react action

Hi all!
I made some rules with react action in them. With afpacket daq mode all is working fine, I see hijacked responses on the client. But when I switch daq to pfring react stops working. In logs I see that snort is matching the rule, but no action... Any help?

Thanks in advance!
Best regards,
Alex

------------------------------------------------------------------------------
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!




More information about the Snort-users mailing list