Flexresp problem

["Tudor Panaitescu" <tpanaitescu () colorcon com>]

Hello Everyone,

Configuration:
  OS: RedHat 7.2 + the latest patches from RH
  Kernel: 2.4.17
  Snort: 1.8.6 + flexresp
  libpcap v0.7.1
  libnet-1.0.2a-1snort
  apache-fp-1.3.22 - 3 instances (see below)

  interfaces: eth0 - IP1, eth0:1 - IP2, eth0:2 - IP3
  snort runs as root and "listens" on eth0

Situation: no resp configured for web-frontpage "access to shtml.exe" and still
all the connections to http://IP[1,2,3]/shtml.exe* from !HOME_NET are reset. The
same for "author.exe" rules, no resp configured but the connections from
!HOME_NET are reset.

Do you know what's all about ?

Thanks in advance,
Tudor




_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users