Re: react: block

[cc <cc () belfordhk com>]

Matt Kettler wrote:

> Heh, "react: block" basically causes snort to use flexresp to try to
> reset the connection.
>
> Of course, if the transfer consists only of one packet, resetting the
> connection won't matter.
>
> Also in the case of very small http'ed images and snort running stream4,
> you won't likely try to issue a reset until the image is done anyway.

Oh darn.  I was hoping to also use snort as a wannabe-proxy :).

Seriously, my knowledge in this is still shallow so there's still ways
for me to understand all this.


Thanks for the info, Matt!

Edmund


** All information contained in this email is strictly     **
** confidential and may be used by the intended receipient **
** only.                                                   **