Re: Layer2resets functionality in snort 2.9

[snort user <snort.user () gmail com>]

Found the answer. This functionality is handled using the DAQ inject API.

On Mon, Oct 3, 2011 at 10:15 AM, snort user <snort.user () gmail com> wrote:
> Hi all -
>
> layer2resets configuration option is currently obsolete. Is this
> capability still present in some other way? How does snort craft a TCP
> RST segment including the layer 2 headers and send it directly to the
> interface instead of routing the TCP RST via the IPSs network stack ?
> I am looking at active.c and encode.c etc but if someone could throw
> some light on the basic approach it may be really helpful.
>
> Thanks in advance for your help.

------------------------------------------------------------------------------
All the data continuously generated in your IT infrastructure contains a
definitive record of customers, application performance, security
threats, fraudulent activity and more. Splunk takes this data and makes
sense of it. Business sense. IT sense. Common sense.
http://p.sf.net/sfu/splunk-d2dcopy1
_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!