Snort mailing list archives
Re: why old libnet?
From: Matt Kettler <mkettler () evi-inc com>
Date: Mon, 28 Mar 2005 15:43:03 -0500
Joshua Berry wrote:
Probably because it has support for using reject as well as drop, alert and log. The reject keyword allows you to reset the connection rather than just drop it.
Yeah, I was looking at the code and you are correct. I guess I (incorrectly) assumed it somehow used the netfilter reject target to generate the packets. Instead snort generates them itself. ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- why old libnet? Florin Andrei (Mar 27)
- Re: why old libnet? Matt Kettler (Mar 28)
- Re: why old libnet? Florin Andrei (Mar 28)
- Re: why old libnet? Matt Kettler (Mar 28)
- Re: why old libnet? Jeremy Hewlett (Mar 29)
- RE: why old libnet? Eric Hines (Mar 30)
- Re: why old libnet? Jeff Nathan (Mar 31)
- Re: why old libnet? Florin Andrei (Mar 28)
- Re: why old libnet? Matt Kettler (Mar 28)
- <Possible follow-ups>
- RE: why old libnet? Ron Jenkins (Mar 28)
- RE: why old libnet? Joshua Berry (Mar 28)
- Re: why old libnet? Matt Kettler (Mar 28)
- Re: why old libnet? Will Metcalf (Mar 28)
- Re: why old libnet? Matt Kettler (Mar 28)