Snort mailing list archives
Re: snort 2.3.3 --enable-flexresp
From: hans <rosa.schwein () ma yer at>
Date: Mon, 2 May 2005 02:44:05 +0200
hi i think it's a question of speed. i snooped with ethereal and found, snort does already send a frame with the reset-flag. it has an aknowledgement and sequence number which was sent befor from the application. i think, the client does ignore this reset, as it would expect a sequence number, which is higher, than the last one. i did run snort and the network-application on the same server. it seems, snort is always behind the application. the problem does not appear without content:"hello"; as snort has enough time to disconnect. the next frame would come much later, if data came from keyboard. so no problem for snort to disconnect within certain time. best regards hans -- On Mon, Apr 25, 2005 at 10:36:28AM +0200, hans wrote:
hi all i tried the experimental feature '--enable-flexresp' for compiling snort 2.3.3 on solaris 9 ( both sparc and intel plattform ) the first tests did run well, the following rule did disconnect an incomming connection immediate: alert tcp any any <> $HOME_NET 25 (msg:"HELLOon25"; resp:rst_all; ) the next step was to modify this rule sligthly. the disconnect should only appear, if the word "hello" was seen, with this rule: alert tcp any any <> $HOME_NET 25 (msg:"HELLOon25"; content:"hello"; resp:rst_all; ) i telnet to port 25, key in "hello" ( knowing it's not a smtp-dialog ) and nothing happens. i get a logentry, so the rule is involved if the word "hello" is seen, but no disconnect. i searched a lot of time around the internet, but could find any advice, what the problem could be. every advice would be helpfully. just disconnecting any incomming connection could be the idea, a tcpwrapper could this job too. best regards hans -- ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- This SF.Net email is sponsored by: NEC IT Guy Games. Get your fingers limbered up and give it your best shot. 4 great events, 4 opportunities to win big! Highest score wins.NEC IT Guy Games. Play to win an NEC 61 plasma display. Visit http://www.necitguy.com/?r=20 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Re: Snort 2.3.3 available, (continued)
- Re: Snort 2.3.3 available Eric Maheo (Apr 24)
- Re: Snort 2.3.3 available James Riden (Apr 26)
- snort 2.3.3 --enable-flexresp hans (Apr 25)
- Re: snort 2.3.3 --enable-flexresp John C. Silvia (Apr 25)
- Re: snort 2.3.3 --enable-flexresp hans (Apr 27)
- Re: snort 2.3.3 --enable-flexresp hans (Apr 27)
- Re: snort 2.3.3 --enable-flexresp Matt Kettler (Apr 25)
- Re: snort 2.3.3 --enable-flexresp Matt Kettler (Apr 25)
- Re: snort 2.3.3 --enable-flexresp Rich Adamson (Apr 26)
- Re: snort 2.3.3 --enable-flexresp hans (Apr 27)
- Re: snort 2.3.3 --enable-flexresp John C. Silvia (Apr 25)
- Re: snort 2.3.3 --enable-flexresp hans (May 01)
- showing payload hans (May 08)
- Re: Snort 2.3.3 available Eric Maheo (Apr 24)
- RE: Snort 2.3.3 available Harper, Patrick (Apr 26)