Snort mailing list archives
Re: How does a reject rule work?
From: Todd Wease <twease () sourcefire com>
Date: Tue, 29 Apr 2008 11:21:58 -0400
His rule was an ICMP rule. He was sending ICMP packets to trigger the rule. The rule was also a reject rule. ICMP ping packets will not ever get an ICMP Destination port unreachable and the inline code (correctly) only sends ICMP Destination port unreachable for UDP and TCP packets (actually for TCP packets it sends a reset). The ICMP packet will be dropped, but sending a reset or ICMP Destination port unreachable for an ICMP packet makes no sense. I suppose the inline.c code could have another case for ICMP packets and send a code 0, 1 or 2 Destination unreachable packet, but it doesn't. By the way, thanks for the RFC tip. Phil Wood wrote:
Read RFC 792 to understand the ICMP Destination Unreachable Message. "bahamin" not talking about ICMP ports its talking about the messages sent by hosts using ICMP to tell the sender of something that is not "reachable" on the recipients computer (such as a port). One place to find the RFC: ftp://ftp.rfc-editor.org/in-notes/rfc792.txt On Tue, 2008-04-29 at 09:02 -0400, Todd Wease wrote:You're not going to get 'Destination port unreachable' with ICMP packets (they address no port). Try with UDP or TCP packets and rule. bahamin takhtaei wrote:Hi, I wrote an icmp rule with "reject" action and test it by echo request packets (ping), but I didn't catch any "Destination port unreachable" message on the test system. It seems that my "reject" rule works as a "drop" rule only! Now please tell me What do I to fix this problem? Thanks, Bahamin ------------------------------------------------------------------------ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. <http://us.rd.yahoo.com/evt=51733/*http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ ------------------------------------------------------------------------ ------------------------------------------------------------------------- This SF.net email is sponsored by the 2008 JavaOne(SM) Conference Don't miss this year's exciting event. There's still time to save $100. Use priority code J8TL2D2. http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone ------------------------------------------------------------------------ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users------------------------------------------------------------------------- This SF.net email is sponsored by the 2008 JavaOne(SM) Conference Don't miss this year's exciting event. There's still time to save $100. Use priority code J8TL2D2. http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------- This SF.net email is sponsored by the 2008 JavaOne(SM) Conference Don't miss this year's exciting event. There's still time to save $100. Use priority code J8TL2D2. http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- How does a reject rule work? bahamin takhtaei (Apr 29)
- Re: How does a reject rule work? Todd Wease (Apr 29)
- Re: How does a reject rule work? Phil Wood (Apr 29)
- Re: How does a reject rule work? Todd Wease (Apr 29)
- Re: How does a reject rule work? Phil Wood (Apr 29)
- Re: How does a reject rule work? Todd Wease (Apr 29)