Snort mailing list archives
Re: Snort3: no rule for "bad cksum"
From: Meridoff via Snort-users <snort-users () lists snort org>
Date: Thu, 28 Mar 2019 13:58:34 +0300
ср, 27 мар. 2019 г. в 12:26, Meridoff <oagvozd () gmail com>:
Hello, I 've set up in network {} table all options concerning cksum evaluating and bad cksum dropping. All is ok - bad cksum packet is not forwarded through snort. But now messeges in log about it. And I've not found any rule for bad cksum in builtin rules.
Misprinted: "But no messages in log about it"
Why? And how I can recognize that packet with bad cksum was alerted/dropped and so on ? Thanks!
_______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: snort-users-leave () lists snort org Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
Current thread:
- Snort3: no rule for "bad cksum" Meridoff via Snort-users (Mar 27)
- Re: Snort3: no rule for "bad cksum" Meridoff via Snort-users (Mar 28)
- Re: Snort3: no rule for "bad cksum" Russ via Snort-users (Mar 28)
- Re: Snort3: no rule for "bad cksum" Meridoff via Snort-users (Mar 28)