Re: Flexresp problems

[Zakai Kinan <titanyen2000 () yahoo com>]

did you do --enable-react in the configure?  React
works, but flexresp does not work in that version. 
Use snortsam instead.

ZK

--- "Ward, Rob" <Rob.Ward () liverpool ac uk> wrote:

> I've installed with Flexresp and when I try to add
> react:block; to a rule I get the message below, any
> ideas please anyone?
>
> FATAL ERROR: Warning:
> /etc/snort/rules/local.rules(1) => Unknown keyword '
> react' in rule!
>
> The rule syntax looks OK to me and I've used this
> before without a problem. I'm running snort 2.8.0.1
> on Cent OS 5.
>
> The rule looks like this:
>
> alert tcp $HOME_NET any -> $EXTERNAL_NET 8888
> (msg:"P2P napster login";
> flow:to_server,established; content:"|00 02 00|";
> depth:3; offset:1; classtype:policy-violation;
> sid:549; rev:8; react:block;)
>
>
> Also with Flexresp in which file do you put your
> variables i.e:
>
> # just stop the offender
>     var RESP_TCP resp:rst_snd;
>
> I get the same error when I put this in snort.conf
> and replace react:block; with $RESP_TCP in my rules.
> I also get the same error with resp:rst_snd; in the
> rules.
>
> Any help would be appreciated, thanks!
>
> Rob Ward
> Network Northwest Support
> University of Liverpool
> Computing Services Department
-------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio
> 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or
> unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
>



      ____________________________________________________________________________________
Looking for last minute shopping deals?  
Find them fast with Yahoo! Search.  http://tools.search.yahoo.com/newsearch/category.php?category=shopping

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users