-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Nov 28, 2005, at 11:15 AM, Paul Melson wrote:
-----Original Message-----
Subject: [Snort-users] send flex-resp through interface which has no
ip-address!?
how can i manage, that snort sends felxible resps through e.g.
eth0 which
has no ip-address > assigned!?
It is not necessary for the interface to be addressed as flexresp
will spoof
the source and destination address of the FIN or host-unreachable
packets it
is sending to match the connection it is trying to shut down. This
should
work with minimal configuration unless for some reason you cannot send
packets to the network port that Snort is listening on (which would
be a
switch/tap issue, not a Snort issue).
PaulM
That's incorrect. The old flexresp code uses a raw socket, which
makes use of the routing table on any host performing active
response. In other words, it can't use an interface without an IP
address.
- -Jeff
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through
log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD
SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
- --
Now with 100% more mailing lists.
http://nemesis.sourceforge.net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)
iD8DBQFDjcr1Eqr8+Gkj0/0RAmflAKC4tJkcswo3aWTZFVXgj0xOuqdq6wCfTNz7
lLcEwXpLjCUyesxnK/1Pat0=
=hYpv
-----END PGP SIGNATURE-----
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
