Actions
Bug #267
closedProblem with [ipvars] in icmp rule
Status:
Rejected
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:
Description
Trying out:
alert icmp $HOME_NET any -> [8.8.4.4,8.8.8.8] any (msg:"IDS is alive - ping google-dns test signature"; classtype:misc-activity; sid:30100000; reference:url,gamelinux.org; rev:1;)
The above rule does not fire...
Changing it to:
alert icmp $HOME_NET any -> any any (msg:"IDS is alive - ping test signature"; classtype:misc-activity; sid:30100001; reference:url,gamelinux.org; rev:1;)
This rule fires....
Updated by Edward Fjellskål almost 14 years ago
ohhh... crapz.... sårry with a big O...
For some reason, my interface reverted to not the one that I really use, so $HOME_NET did not match, cuz it did not see the package :/
A nice moment to test multiple interfaces though :)
E
Updated by Victor Julien almost 14 years ago
- Status changed from New to Rejected
Not an issue after all :)
Actions