Snort mailing list archives
Re: Layer2resets functionality in snort 2.9
From: snort user <snort.user () gmail com>
Date: Mon, 3 Oct 2011 12:21:44 -0400
Found the answer. This functionality is handled using the DAQ inject API. On Mon, Oct 3, 2011 at 10:15 AM, snort user <snort.user () gmail com> wrote:
Hi all - layer2resets configuration option is currently obsolete. Is this capability still present in some other way? How does snort craft a TCP RST segment including the layer 2 headers and send it directly to the interface instead of routing the TCP RST via the IPSs network stack ? I am looking at active.c and encode.c etc but if someone could throw some light on the basic approach it may be really helpful. Thanks in advance for your help.
------------------------------------------------------------------------------ All the data continuously generated in your IT infrastructure contains a definitive record of customers, application performance, security threats, fraudulent activity and more. Splunk takes this data and makes sense of it. Business sense. IT sense. Common sense. http://p.sf.net/sfu/splunk-d2dcopy1 _______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- Layer2resets functionality in snort 2.9 snort user (Oct 03)
- Re: Layer2resets functionality in snort 2.9 snort user (Oct 03)