Re: Flexresp problem

[Erek Adams <erek () theadamsfamily net>]

On Sun, 14 Apr 2002, Tudor Panaitescu wrote:

[...snip...]

> Situation: no resp configured for web-frontpage "access to shtml.exe" and
> still all the connections to http://IP[1,2,3]/shtml.exe* from !HOME_NET are
> reset. The same for "author.exe" rules, no resp configured but the
> connections from !HOME_NET are reset.
>
> Do you know what's all about ?

Well...  I can only assume something else is going on.

Force this to happen, and capture the traffic to binary as you do so.  Then
trace back over the packets to see what's causing the reset--Webserver or
Snortbox.  That would show you your culprit.

Also check your apache error_log file.  Perhaps you've got some apache
redirects going on?  Maybe someone else is session sniping on your net?

Lotsa things that it could be....  Just need to get more info on what's
causing it.

Cheers!

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users