Re: flexresp

[Grant Parkinson <grantp () userid0 com>]

If the snort sensor is not serving as a GW it should be located on a 
segment or mirrored port through which it can view the connections you 
would like to RST.  Snort is not modifying the data 'in-flight', it is 
sending an RST with spoofed source addr and sequence.

Have a look at README.FLEXRSP for additional info.

--
 grant p.


> I built snort machine with mysql support.I didn't include flexresp. I just
> wonder-can I use flexresp if machine is not a default gateway for the
> network? If it is not the dg, then how it will reset some connections and
> prevent them from getting inside the network?
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users




_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users