OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: [Snort-users] FlexResp support (Bug with "-o" option)
From: Jason Haar (Jason.Haartrimble.co.nz)
Date: Mon Sep 04 2000 - 22:59:55 CDT

Says it all really. I was successfully using " resp: rst_all" on a rule,
then decided I wanted to ignore ICMP packets from a monitor box we run. So I
put in a "pass ICMP..." rule and set snort to run with the "-o" option. Well
the moment I did that, the FlexResp component stopped working :-(

Is this a bug, and anyhow, how can I set up snort with "pass" rules besides
the "-o" option? Or is it that if you want to ignore certain packets, you
_have_ to use "-o"? I can't get "pass" to be seen any other way... 

-- 
Cheers

Jason Haar

Unix/Network Specialist, Trimble NZ
Phone: +64 3 9635 377 Fax: +64 3 9635 417
               
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
http://lists.sourceforge.net/mailman/listinfo/snort-users