resp 2?

["Ben Johansen" <benj () intelisoft net>]

Hi All, (Newbie version 1.1)

apparently when I responded to the to last it went to the individual instead
of the list. ??

but, here is more on my resp problem.

When I Tried to run Snort with the Rule modified with the "resp"
version 1.7 on Win-32 it displayed an error stating it didn't recognize
the resp and snort didn't load.

Rule:
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"WEB-MISC-cmd.exe
Attempt";flags:PA; resp: rst_all; content:"scripts/../../cmd.exe"; nocase;)

I Guess, the main question for me now is: Now that I see the hack attempts
what do I with them?

Ben Johansen



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users