Re: React option doesn't work

["Al Lewis (allewi)" <allewi () cisco com>]

That looks to be an Emerging Threat rule so you probably would want to contact them about that. There isnt a 
"content-list" rule option. The rule options are listed here: http://manual.snort.org/node32.html

As for the block page are you listing the page with the "config react: <block.html>" in your config file? The steps are 
listed here http://manual.snort.org/node26.html under the "react" section. 

Note that the block|warn options under react are deprecated so you may want to try removing the 'block' from the react 
option.


This is taken from the manual:

This is an example rule: 


    drop tcp any any -> any $HTTP_PORTS ( \
        content: "d"; msg:"Unauthorized Access Prohibited!"; \
        react: <react_opts>; sid:4;)

    <react_opts> ::= [msg] [, <dep_opts>]


These options are deprecated: 


    <dep_opts> ::= [block|warn], [proxy <port#>]



Hope this helps.

Albert Lewis
QA Software Engineer
SOURCEfire, Inc. now part of Cisco
9780 Patuxent Woods Drive
Columbia, MD 21046 
Phone: (office) 443.430.7112
Email: allewi () cisco com 

-----Original Message-----
From: Robert Lasota [mailto:wrkilu () wp pl] 
Sent: Friday, March 27, 2015 5:27 AM
To: snort-users
Subject: [Snort-users] React option doesn't work

Hi,

I've installed newest Snort (2.9.7.2) from source with options:
 ./configure --prefix=/opt/usr  --enable-sourcefire --with-daq-libraries=/opt/usr/lib/daq/ 
--with-daq-includes=/opt/usr/include/ --disable-gre --disable-mpls --disable-corefiles --disable-dlclose --enable-react 
--enable-active-response --enable-flexresp3

I run it in inline mode with options:
--daq nfq --daq-var queue=0 -D -Q -c /opt/etc/snort/snort.conf -l /var/log/snort --no-interface-pidfile

.. and its blocking traffic but unfortunately doesn't display message in webbrowser about this block.

Rule is:
drop tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (content-list:"exe"; msg:"ET CURRENT_EVENTS Terse alphanumeric 
executable downloader high likelihood of being hostile"; flow:established,to_server; content:"/"; http_uri; 
content:".exe"; distance:1; within:8; fast_pattern; http_uri; content:!"Referer|3a 20|"; nocase;  http_header; 
pcre:"/\/[A-Z]?[a-z]{1,3}[0-9]?\.exe$/U"; classtype:bad-unknown; sid:2019714; rev:2;  react: block, msg; )

without content-list:"exe" it just blocks, with content-list:"exe" don't even start because it has error:  Unknown rule 
option: 'content-list'.

So, what is going on ? how to fix it or... what is other way to display message in webbrowser during blocking (in 
inline mode with DAQ which we are using) ?

Please help us, we work on serious project with Snort and this is very important for us

Robert Lasota





------------------------------------------------------------------------------
Dive into the World of Parallel Programming The Go Parallel Website, sponsored by Intel and developed in partnership 
with Slashdot Media, is your hub for all things parallel software development, from weekly thought leadership blogs to 
news, videos, case studies, tutorials and more. Take a look and join the conversation now. 
http://goparallel.sourceforge.net/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

------------------------------------------------------------------------------
Dive into the World of Parallel Programming The Go Parallel Website, sponsored
by Intel and developed in partnership with Slashdot Media, is your hub for all
things parallel software development, from weekly thought leadership blogs to
news, videos, case studies, tutorials and more. Take a look and join the 
conversation now. http://goparallel.sourceforge.net/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!