Re: Snort+flexresp

[Roelof JT Jonkman <roel () SiliconDefense com>]

Sonika,

>     Thanks for this detail explanation.Does this indicate that in every( WAN )
> case where the delay is more ,the possibility of RST packet, generated by snort,
> reaching the other end increases? That is if the no. of hops are more, it is more
> likely that the snort terminates the connection.
Yes, that would be correct to assume.

> But in any case it is not
> guaranteed!..
Yes, it propably be accurate to say that 9 out of 10 times it works in a WAN
situation. (Somewhere during 1.8.3 Marty changed a bunch of the flexible 
response code around so it prebuild's the the RST packets, that did it quite
a bit of good.)

                roel



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users