<div dir="ltr">Thanks. It now works as you said.<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Feb 12, 2015 at 3:47 PM, Russ <span dir="ltr"><<a href="mailto:rucombs@...589..." target="_blank">rucombs@...589...</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
  
    
  
  <div bgcolor="#FFFFFF" text="#000000"><span class="">
    <br>
    <div>On 2/12/15 2:33 AM, Mark Greenman
      wrote:<br>
    </div>
    <blockquote type="cite">
      
      <div dir="ltr">
        <div>
          <div>Thanks for your response and sorry that I'm answering a
            little late.<br>
          </div>
          You are right sir. But I think active responses are needed for
          "reject" rules. Actually, based on the manual snort must sent
          TCP reset or ICMP unreachable for reject rules and not for the
          drop rules. I think what I see is that "drop" and "reject"
          work exactly the same.<br>
        </div>
      </div>
    </blockquote></span>
    They are the same only because your config tells Snort to handle
    drops as rejects.  This config allows drops and rejects to work "at
    face value":<br>
    <br>
    config response: attempts 1<br>
    #<br>
    preprocessor stream5_global: track_tcp yes, track_udp no<br>
    preprocessor stream5_tcp: policy linux<br>
    #<br>
    drop tcp any any -> any 80 ( sid:1; msg:"block only";
    content:"foo"; )<br>
    reject tcp any any -> any 80 ( sid:2; msg:"block and reject";
    content:"bar"; )<div><div class="h5"><br>
    <br>
    <blockquote type="cite">
      <div dir="ltr">
        <div>Thanks again<br>
        </div>
      </div>
      <div class="gmail_extra"><br>
        <div class="gmail_quote">On Mon, Feb 9, 2015 at 4:24 PM, Russ <span dir="ltr"><<a href="mailto:rucombs@...589..." target="_blank">rucombs@...589...</a>></span>
          wrote:<br>
          <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000"> You have active
              responses enabled with the configuration below.  That
              causes Snort to send TCP resets or ICMP unreachables when
              a session is blocked.<br>
              <br>
              preprocessor stream5_global: track_tcp yes, \<br>
              ...<br>
                 max_active_responses 2, \<br>
                 min_response_seconds 5
              <div>
                <div><br>
                  <br>
                  <div>On 2/8/15 5:22 AM, Mark Greenman wrote:<br>
                  </div>
                  <blockquote type="cite">
                    <pre>The configuration file, the rules and a pcap file captured at the
client side are attached to the email.
Thanks

On 2/7/15, Joel Esler (jesler) <a href="mailto:jesler@...589..." target="_blank"><jesler@...589...></a> wrote:
</pre>
                    <blockquote type="cite">
                      <pre>Drop shouldn't send anything.  So if you are seeing this, we need your
configuration, rules, and a pcap.

--
Joel Esler
Sent from my iPhone

On Feb 7, 2015, at 8:29 AM, Mark Greenman
<<a href="mailto:mark.greenman.014@...11827..." target="_blank">mark.greenman.014@...11827...</a><a href="mailto:mark.greenman.014@...14542...." target="_blank"><mailto:mark.greenman.014@...11827...></a>> wrote:

Hi. Do you know why both drop and reject rules work exactly the same. The
manual says that drop rules must not sent RST packets but they do? Does
anyone know the reason?

Thanks
------------------------------------------------------------------------------
Dive into the World of Parallel Programming. The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is
your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. <a href="http://goparallel.sourceforge.net/" target="_blank">http://goparallel.sourceforge.net/</a>
_______________________________________________
Snort-users mailing list
<a href="mailto:Snort-users@lists.sourceforge.net" target="_blank">Snort-users@lists.sourceforge.net</a><a href="mailto:Snort-users@...3054...forge.net" target="_blank"><mailto:Snort-users@lists.sourceforge.net></a>
Go to this URL to change user options or unsubscribe:
<a href="https://lists.sourceforge.net/lists/listinfo/snort-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-users</a>
Snort-users list archive:
<a href="http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users" target="_blank">http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users</a>

Please visit <a href="http://blog.snort.org" target="_blank">http://blog.snort.org</a> to stay current on all the latest Snort
news!

</pre>
                      <br>
                      <fieldset></fieldset>
                      <br>
                      <pre>------------------------------------------------------------------------------
Dive into the World of Parallel Programming. The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. <a href="http://goparallel.sourceforge.net/" target="_blank">http://goparallel.sourceforge.net/</a></pre>
                      <br>
                      <fieldset></fieldset>
                      <br>
                      <pre>_______________________________________________
Snort-users mailing list
<a href="mailto:Snort-users@lists.sourceforge.net" target="_blank">Snort-users@lists.sourceforge.net</a>
Go to this URL to change user options or unsubscribe:
<a href="https://lists.sourceforge.net/lists/listinfo/snort-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-users</a>
Snort-users list archive:
<a href="http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users" target="_blank">http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users</a>

Please visit <a href="http://blog.snort.org" target="_blank">http://blog.snort.org</a> to stay current on all the latest Snort news!</pre>
                    </blockquote>
                  </blockquote>
                  <br>
                </div>
              </div>
            </div>
          </blockquote>
        </div>
        <br>
      </div>
    </blockquote>
    <br>
  </div></div></div>

</blockquote></div><br></div>