Project

General

Profile

Actions
Copy link

Feature #9289

open

Snort enable react

Added by Theo Wolf almost 6 years ago. Updated almost 6 years ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
Snort
Target version:
-
Start date:
01/23/2019
Due date:
% Done:

0%

Estimated time:
Plus Target Version:

Description

I like to use the "config enable_react" parameter to show a http site on blocked ips. The SNORT package dont't know this config parameter so I think this option is not used during the build.
Could you please use "./configure --enable-react / -DENABLE_REACT" as an additional build option in further builds?

Thanks,
Theo

Actions
Copy link
 #1

Updated by Jared Dillard almost 6 years ago

  • Category set to Snort
Actions
Copy link
 #2

Updated by Bill Meeks almost 6 years ago

Snort on pfSense currently runs in what is really IDS mode using libpcap. The "blocking" done by Snort uses a custom output plugin that interacts with the pf (packet filter) firewall in FreeBSD. In order to use the REACT mode, Snort must be running using Inline IPS mode. That mode is not currently supported on pfSense.

Actions
Copy link

Also available in: Atom PDF