Re: [Snort-devel] problem with react, resp.

From: chiba4mail <chiba4mail(at)yahoo.it>
Date: Tue Apr 27 2004 - 08:22:48 EDT

• jvarlet@ares51.fr ha scritto: >
  > Hi,
  >
  > I created a snort rule (just to test) to have some
  reaction
  > with an attack.
  > This rule works good when i do not add "react" or
  "resp" in the rule.

> my snort version : 2.1.1 (build 24)

> ma regle :
> alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS
$HTTP_PORTS (msg:"TEST"; content:"SEARCH"; classtype:attempted-admin;depth:8; nocase; react:block, msg; sid:62354; rev:8;)

> In /var/log/messages :
> FATAL ERROR : ....=> Unknown keyword ' react'
> Snort does not boot.....

> Can you help me ?

Did you use the --enable-flexresp option with configure script?

Bye,
Alex                                   

---

Yahoo! Companion - Scarica gratis la toolbar di Ricerca di Yahoo! http://companion.yahoo.it

---

This SF.net email is sponsored by: The Robotic Monkeys at ThinkGeek For a limited time only, get FREE Ground shipping on all orders of $35 or more. Hurry up and shop folks, this offer expires April 30th! http://www.thinkgeek.com/freeshipping/?cpg=12297

---

Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel Received on Tue Apr 27 08:38:50 2004