Event Action : Reset/Shunhost pb

[meether]

Hello,

If I modify the action of the signature 4701 (MSSQL Control Overflow) from "ZERO" to "reset/shunhost", I don't see any host in the host manual blocks panel.

If I choose "shunhost", it's ok.

I don't understand why. With others signatures pre-defined at "reset/shunhost" (5126 : IIS .ida Indexing Service Overflow ...) there is no problem.

Can someone help me please ?

Thanks

[marcabal]

This should work.

Can you provide a snip from "show configuration" that shows the action configuration for signature 4701 to ensure that the configuration is correct.

As well as the output of "show events" showing that signature firing. The "show events" output will show whether or not a TCP Reset was attempted and if a Shun Host was attempted.

[jlively]

while you are at it a show stat net would help