react:

["Shawn Workman" <sworkman () onecall com>]

I have compiled and installed snort Version 1.9.0 (Build 209) on one of our
FreeBSD Servers here at work.

It was made with WITH_FLEXRESP.

I have some rules that use resp:rst_all and they seem to work ok, blocking
connections after about 3 consecutive packets or so.

I cannot get react: block; to work.

here is the rule:

alert tcp any any <> any any (content:"xxx.com"; msg:"Not for children!";
react:block;)

I go to the page and it loads no problem.


Any help is greatly appreciated.