Snort 3 resets not working. Question?

Hello!

I am running snort 3 inline mode and trying to get active response to work.
When I ping a host located behind snort inline I get a "connection timeout"
when I with active response and reject action in rule should get
"Destination port unreachable"....???
When I look at the snort log it reads [reset], so the reset should be sent
but still "connection timeout" when sending a ping...
Below are my configs:

ips =
{
mode = inline,
enable_builtin_rules = true,
variables = default_variables,
rules = [[ rules-here ]]
}

reject = { control="all", reset="both" }

active = { attempts = 2, device = "eth0", dst_mac = "mac-addr-of-eth0",}

normalizer = { tcp = { ips = true, } }


Starting snort with:

snort -c snort.lua --daq-dir /usr/local/lib/daq --daq afpacket --daq-var
fanout_type=hash \
-s 65535 -k none -l /var/log/snort -Q -i eth0:enx5ca6e6fb7f8a -u snort -g
snort -D


And icmp rule:
reject icmp any any -> any any (msg:"icmp"; sid:1; )


Any ideas what is wrong/missing??

/Gustaf

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette