Snort mailing list archives
Re: More explanation needed in Snort User Manual for "resp:"?
From: Chris Green <cmg () sourcefire com>
Date: Thu, 06 Nov 2003 16:30:12 -0500
Jason Haar <Jason.Haar () trimble co nz> writes:
I've looked at flexresp2, and it allows you to explicitly configure which interface RESET packets are set through - which is almost there. But this still seems like a bug to me, as I can't think of a reason why you would ever want the packet to leave through anything other than the interface it was seen on! [well, except one: TAPs - but that's pretty special case] Am I missing something here?
You have the problem space down. Asynchronous routing -i any or -i bond0 will throw away almost any info you could. -- Chris Green <cmg () sourcefire com> This is my signature. There are many like it but this one is mine. ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- More explanation needed in Snort User Manual for "resp:"? Jason Haar (Nov 06)
- Re: More explanation needed in Snort User Manual for "resp:"? Chris Green (Nov 06)
- Re: More explanation needed in Snort User Manual for "resp:"? Jason Haar (Nov 06)
- Re: More explanation needed in Snort User Manual for "resp:"? Kristofer T. Karas (Nov 06)
- Re: More explanation needed in Snort User Manual for "resp:"? Jason Haar (Nov 06)
- Re: More explanation needed in Snort User Manual for "resp:"? Jeff Nathan (Nov 20)
- Re: More explanation needed in Snort User Manual for "resp:"? Matt Kettler (Nov 06)
- Re: More explanation needed in Snort User Manual for "resp:"? Chris Green (Nov 06)