FlexResp

[Motoki Yokoyama <yokoyama () exa onlab ntt co jp>]

Hi All,

I'm trying "FlexResp" function in snort-1.9.0 on RedHat7.3.
But my snort reply both SYN/ACK and RST/ACK to "TCP connection 
scan" and "TCP Half Scan" On the other hand the snort reply 
RST/ACK to "FIN scan", "Xmas Scan", and "NULL scan". Doesn't 
the snort operate to "TCP connection scan" and "TCP Half Scan" 
as same as to "FIN scan", "Xmas Scan", and "NULL scan"?
I expect to reply RST/ACK to all these scan.

Please give me any advice to my problem.

The signature of this test is following:

 alert tcp 10.6.21.10 any -> 10.6.21.1 22
 (msg:"Resp"; resp:rst_snd; sid:1000009;)

where, 10.6.21.10 is a remote host.

Other information of my snort environment is following:
 ・libpcap-0.6.2-2cl.i386.rpm
 ・libpcap-devel-0.6.2-2cl.i386.rpm
 ・libnet-1.0.2a-2.i386.rpm

Thanks


-------------------------------------------------------
This SF.net email is sponsored by: Get the new Palm Tungsten T 
handheld. Power & Color in a compact size! 
http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0002en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users