RE: Flexresp

["Bill Shaffer" <billshaffer () smsd org>]

To elaborate on what Chris stated yes Flexrep gives you the ability to
send RST packets to the hostile computer and to your stations but this
is not fully functioning with win32, this is still in beta. The other
problem that has been stated is that while the crafted packet is being
constructed your computer (if on a fast network) can reply to the
hostile packet before snort can send the RST packet. 

Anyone can please correct me if I said that wrong...

Hope this helps,
Bill

-----Original Message-----
From: Chris Green [mailto:cmg () uab edu] 
Sent: Wednesday, January 16, 2002 11:39 AM
To: Sean T. Ballard
Cc: snort-users () lists sourceforge net
Subject: Re: [Snort-users] Flexresp

"Sean T. Ballard" <stballard () 4glschools com> writes:

> Does anyone have a white paper on Flexresp? I tried locating more
> info on it at snort.org but found nothing conclusive.  Now flexresp
> is the ability accept or deny access based on the rules file
> correct? any info would be appreciated.

It's the ability to send disruptive packets to the hosts involved.
Since snort isn't in the way of the connections, its not accepting or
denying access.

It's a good try but not something to rely on 100%.
-- 
Chris Green <cmg () uab edu>
Laugh and the world laughs with you, snore and you sleep alone.

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users