snort_inline in replace mode?

[Maximillian Dornseif <dornseif () informatik rwth-aachen de>]

I have a problem with snort_inline in replace mode: When I run it of 
the honeywall CD-ROM it basically mangels ssh banners so I can't log 
into the honeypot. Does anybody else has this problem? Does anybody 
else actually use replace Rules?

Some more examples of what I found with snort_inline rerplacing stuff 
can be found at http://blogs.23.nu/antlab/stories/6909/

Regards

Maximillian Dornseif

--
Maximillian Dornseif, Dipl. Jur.
Laboratory for Dependable Distributed Systems, RWTH Aachen University
Tel. +49 241 80-21431 - http://md.hudora.de/