Snort mailing list archives
Re: Flexresp problems
From: Zakai Kinan <titanyen2000 () yahoo com>
Date: Sun, 24 Feb 2008 15:43:12 -0800 (PST)
Where are the configuration options for flexresp version 1? I can't find them. TIA, ZK --- Todd Wease <twease () sourcefire com> wrote:
flexresp2 is broken in Snort 2.8.0 because of the inclusion of IPv6 support in Snort - there are conflicting types in the Snort code and libdnet. This should be fixed in the 2.8.1 release (not sure on the date yet for this release). Use the original flexresp (--enable-flexresp) if you want to block requests or send resets. Zakai Kinan wrote:Are you saying that I should use --enable-flexresp instead of --enable-flexresp2? --enable-flexresp2 does not work for me with my configure optionsused.Some clarification would be helpful. Thanks, ZK --- Todd Wease <twease () sourcefire com> wrote:Rob, I just tested this and it seems to work fine with the 2.8.0.1 tarball on the snort.org site. Can you post the commandlineyou used to configure Snort? The configure line I used was: $ ./configure --enable-pthread --enable-linux-smp-stats --enable-dynamicplugin --enable-sourcefire --enable-gre --enable-targetbased --enable-flexresp The rule I used was: alert tcp $HOME_NET any -> 192.168.0.2 80(msg:"Youbastard"; flow:to_server,established; content:"cmd.exe"; nocase; classtype:policy-violation; sid:100000001; rev:8; react:block;) The snort.conf I used was the default one withtheabove rule added at the end of the file. The snort command line I used was (running fromtoplevel of source tree): $ sudo ./src/snort -c ./etc/snort.conf.work -knone-A cmg -i eth0 When I tried to use the url "http://192.168.0.2/cmd.exe", I got an alert as well as the flexresp react block page sent tomybrowser. Also tried the resp rule: alert tcp $HOME_NET any -> 192.168.0.2 80(msg:"Youbastard"; flow:to_server,established; content:"cmd.exe"; nocase; classtype:policy-violation; sid:100000001; rev:8; resp:rst_snd;) and I get a message sent to my browser that the connection was reset. This was not tested on a Cent OS 5 machine, but a Fedora Core 8 intel. I downloaded libnet-1.0.2a.tar.gz and just didthenormal './configure && make && sudo make install'. Thanks, Todd Ward, Rob wrote:I've installed with Flexresp and when I try toaddreact:block; to a rule I get the message below,anyideas please anyone?FATAL ERROR: Warning:/etc/snort/rules/local.rules(1) => Unknownkeyword 'react' in rule!The rule syntax looks OK to me and I've usedthisbefore without a problem. I'm running snort2.8.0.1on Cent OS 5.The rule looks like this: alert tcp $HOME_NET any -> $EXTERNAL_NET 8888(msg:"P2P napster login"; flow:to_server,established; content:"|00 02 00|"; depth:3; offset:1; classtype:policy-violation; sid:549; rev:8; react:block;)Also with Flexresp in which file do you put yourvariables i.e:# just stop the offender var RESP_TCP resp:rst_snd; I get the same error when I put this insnort.confand replace react:block; with $RESP_TCP in myrules.I also get the same error with resp:rst_snd; intherules.Any help would be appreciated, thanks! Rob Ward Network Northwest Support University of Liverpool Computing Services Department
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options orunsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
____________________________________________________________________________________
Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now.
http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options orunsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
=== message truncated === ____________________________________________________________________________________ Looking for last minute shopping deals? Find them fast with Yahoo! Search. http://tools.search.yahoo.com/newsearch/category.php?category=shopping ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Flexresp problems Ward, Rob (Feb 19)
- Re: Flexresp problems Zakai Kinan (Feb 19)
- Re: Flexresp problems Todd Wease (Feb 21)
- Re: Flexresp problems Ward, Rob (Feb 21)
- Re: Flexresp problems Zakai Kinan (Feb 22)
- Re: Flexresp problems Todd Wease (Feb 22)
- Re: Flexresp problems Zakai Kinan (Feb 24)
- Re: Flexresp problems Jeff Nathan (Feb 25)