Re: snort react action

["Al Lewis (allewi)" <allewi () cisco com>]

Hello,

        What version of snort are you using? 
        What rule are you using?
        What command are you using to start snort?
        Do you have a config file you can share?

Need a little more information sorry.

Albert Lewis
QA Software Engineer
SOURCEfire, Inc. now part of Cisco
9780 Patuxent Woods Drive
Columbia, MD 21046 
Phone: (office) 443.430.7112
Email: allewi () cisco com 


-----Original Message-----
From: free [mailto:free.aaa () gmail com] 
Sent: Wednesday, April 06, 2016 3:28 AM
To: snort-users () lists sourceforge net
Subject: [Snort-users] snort react action

Hi all!
I made some rules with react action in them. With afpacket daq mode all is working fine, I see hijacked responses on 
the client. But when I switch daq to pfring react stops working. In logs I see that snort is matching the rule, but no 
action... Any help?

Thanks in advance!
Best regards,
Alex

------------------------------------------------------------------------------
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

------------------------------------------------------------------------------
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!