Snort mailing list archives
reject is identical to drop
From: HN Nguyen <nhncontact () gmail com>
Date: Wed, 6 Jul 2011 17:24:53 -0700
I'm using snort (v2.9.0.5) inline with iptables. I have a rule with "reject" action, but when it triggers, no packet is sent back to the sender (tcpdump on all interfaces confirm this). The rule is: reject tcp any any -> any 7 The log shows: 07/07-00:15:19.553113 [Drop][Priority: 0] {TCP} 192.168.41.122:38805 -> 192.168.1.57:7 This is identical to the behaviour when I change the action to "drop". Is there anything I'm missing or doing wrong? Thanks.
------------------------------------------------------------------------------ All of the data generated in your IT infrastructure is seriously valuable. Why? It contains a definitive record of application performance, security threats, fraudulent activity, and more. Splunk takes this data and makes sense of it. IT sense. And common sense. http://p.sf.net/sfu/splunk-d2d-c2
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Please see http://www.snort.org/docs for documentation
Current thread:
- reject is identical to drop HN Nguyen (Jul 06)
- Re: reject is identical to drop Kevin Ross (Jul 07)
- Re: reject is identical to drop Russ Combs (Jul 07)
- Re: reject is identical to drop HN Nguyen (Jul 07)
- Re: reject is identical to drop Russ Combs (Jul 07)
- Re: reject is identical to drop Kevin Ross (Jul 07)