RE: [Snort-inline-users] Reloading rules

[Brian J. <te...@ja...>]

>do you have enforce_state enabled under the stream4 section of your
>snort_inline.conf?

Will,
	No, I had a very simplistic stream4 of just 'preprocessor stream4:
disable_evasion_alerts'. So I added enforce_state this made no difference to
a reload. So I added stream4inline, again lock up on sending a SIGHUP.

	The line now reads:- 'preprocessor stream4: disable_evasion_alerts,
stream4inline, enforce_state'.

Any thoughts? By the way it is version 2.3.3.
regards,
Brian.