rules: react

[Vsevolod Zaika <Vsevolod_Zaika () iss org ua>]

Is somebody use 'react' in rules?
I have installed LibNet-1.0.2a, configured and 
maked snort-1.8.1-RELEASE (build 74) 
whith --enable-flexresp.

i have included in some rules following:
 
alert tcp [bla-bla-bla] ( [bla-bla-bla]; react: block,warn; )
                                           (or simply block)

(i receive no error messages during snort starting)

but when this rule ativated nothing except logging happens.
(no session close, no warning messages to attackers etc.)

command line options to snort are:

./snort -sIDN

OS: FreeBSD 4.1.1-RELEASE.

What is wrong?

Thank you for help.


-- 
WBR, Vsevolod I. Zaika,
ISS system administrator.

[VZ666-RIPE] [VIZ1-UANIC]

Attachment: Vsevolod_Zaika.vcf
Description: Card for Vsevolod Zaika