Re: Snort drops the incoming HTTP response packets

Thank you very much for your efforts! I uploaded all the information you
might need (and a little more) to
https://drive.google.com/file/d/14Wu-zLI_L8BZxpArEC5EYAgLfeo46X0a/view?usp=sharing
It's a ZIP file, which I will delete in a few days. After decompressing,
please start with reading README.txt.

Thank you in advance for your help,

Tamás Németh
IT sysadmin
Waterworks of Sopron, Hungary

Al Lewis (allewi) <[email protected]> ezt írta (időpont: 2022. aug. 24.,
Sze, 22:44):

> Hello,
>
> Can you share the configuration you are using? Do you have a pcap of the
> traffic in question?
>
> *Albert Lewis*
>
> ENGINEER.SOFTWARE ENGINEERING
>
> SOURCE*fire*, Inc. now part of *Cisco*
>
> Email: [email protected]
> ------------------------------
> *From:* Snort-users <[email protected]> on behalf of
> Tamás Németh via Snort-users <[email protected]>
> *Sent:* Wednesday, August 24, 2022 11:13 AM
> *To:* [email protected] <[email protected]>
> *Subject:* [Snort-users] Snort drops the incoming HTTP response packets
>
> Dear All!
>
>  I face the problem that snort drops the incoming HTTP response packets
> from a certain unencrypted HTTP website, but it does not log the
> dropping event in /var/log/snort/alert , so I have no idea, which rule is
> responsible (if a rule does in anyway). I'm using the registered
> rules snortrules-snapshot-29200.tar.gz , and the website is http://mekh.hu
>
>
>  How could I figure out the reason of snort to drop these packets.
>
> Thank you in advance,
>
> Tamás Németh
> IT sysadmin
> Waterworks of Sopron, Hungary
>

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette