Re: Snort 3 resets not working. Question?

You wouldn’t receive a RST packet to an icmp transmission.  RST would be for tcp.  

— 
Sent from my  iPhone

> On May 24, 2022, at 14:35, Gustaf Florén via Snort-users <[email protected]> wrote:
> 
> 
> Hello!
> 
> I am running snort 3 inline mode and trying to get active response to work.
> When I ping a host located behind snort inline I get a "connection timeout" when I with active response and reject action in rule should get "Destination port unreachable"....???
> When I look at the snort log it reads [reset], so the reset should be sent but still "connection timeout" when sending a ping...
> Below are my configs:
> 
> ips =
> {
> mode = inline,
> enable_builtin_rules = true,
> variables = default_variables,
> rules = [[ rules-here ]]
> }
> 
> reject = { control="all", reset="both" }
> 
> active = { attempts = 2, device = "eth0", dst_mac = "mac-addr-of-eth0",}
> 
> normalizer = { tcp = { ips = true, } }
> 
> 
> Starting snort with:
> 
> snort -c snort.lua --daq-dir /usr/local/lib/daq --daq afpacket --daq-var fanout_type=hash \
> -s 65535 -k none -l /var/log/snort -Q -i eth0:enx5ca6e6fb7f8a -u snort -g snort -D
> 
> 
> And icmp rule:
> reject icmp any any -> any any (msg:"icmp"; sid:1; )
> 
> 
> Any ideas what is wrong/missing??
> 
> /Gustaf
> _______________________________________________
> Snort-users mailing list
> [email protected]
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
> 
>    To unsubscribe, send an email to:
>    [email protected]
> 
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
> 
> Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette