Snort
Six Tuur via Snort-users <[email protected]>
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <AM4PR07MB3490D49271208336AD3AB8D3CCF49@AM4PR07MB3490.eurprd07.prod.outlook.com> |
Hoi I already sent a mail with my problem for IPS and there has been explained that it must be in a device string for example ens33:ens34. Yes it works if you set it in oneline in the prompt itself. --> But for me it creates fake drop packets when I dropped the ICMP (/etc/snort/rules/local.rules) the real ones don't drop. How do you set the device string in the snort.conf file? I want my IPS to run in the background and work fine so if I sent a packet it drops, but I don't necesseraly have to see it drops. Cheers Tuur Six _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette