Re: [Snort-devel] tag behavior in 2.0.6+

On Sun, 2004-02-29 at 05:16, Andreas Östling wrote:

> It looks like this change was intentional (by removing the reverse host

I support this request. The old behaviour allows one to capture responses to actions by a would be intruder. Often these are enough to confirm whether or not the attack succeeded.

One supplementary question: does snort include anything in the log which links the tagged packets with the packet that caused the tagging to take place? I'm getting tagged packets turning up in ACID and I can't figure out where they are from...  

-- 
Russell Fulton                                    /~\  The ASCII
Network Security Officer                          \ /  Ribbon Campaign
The University of Auckland                         X   Against HTML
New Zealand                                       / \  Email!




-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id56&alloc_id438&opick
_______________________________________________
Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel