Re: [Snort-inline-users] Blocking Anomalous Events

[Josh B. <jos...@ne...>]

I'm sorry, I knew that the preprocessors didn't block packets, I just
didn't realize that the config variables were considered preprocessors
(such as)

config disable_tcpopt_experimental_alerts
config disable_tcpopt_ttcp_alerts
etc.

What would it take to make these drop packets?  Would it be a lot of work?

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Thu, 27 Nov 2003, Stephan Scholz wrote:
>
>> I don't believe that any preprocessor actually blocks at the moment.
>> Correct me if I'm wrong, Rob. :-)
>
> That is correct.  None of the preprocessors actually drop packets.
> However, it would be really easy to make them do such things.
>
> Rob
>
> -----BEGIN PGP SIGNATURE-----
> Version: PGP 6.5.8
> Comment: Made with pgp4pine 1.76
>
> iQA/AwUBP8YgYvnAyY+9KLjdEQLWcwCg5O2lEaVJvnZkJ8lY/MuSE/jIEgcAoIps
> fODuls9TnJDRNtbzec+Cu+EU
> =3UcE
> -----END PGP SIGNATURE-----
>
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: SF.net Giveback Program.
> Does SourceForge.net help you be more productive?  Does it
> help you create better code?  SHARE THE LOVE, and help us help
> YOU!  Click Here: http://sourceforge.net/donate/
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>


Thanks,
Josh Berry, CTO
LinkNet-Solutions
469-831-8543
jos...@li...