IDS mailing list archives
Re: Snort inline and iptables
From: Michal Melewski <mike () pn66 poznan sdi tpnet pl>
Date: Mon, 22 Aug 2005 22:03:38 +0200
Dnia 22-08-2005, pon o godzinie 05:29 +0000, afshinlamei () gmail com napisaĆ(a):
Dear all, 1- can i use snort inline+iptables in router (no bridge) mode under linux?
Yes, you can. All you have to do, is to redirect all your incoming (and possibly outgoing) traffic to QUEUE target in your iptables rules.
2- what's the performance issuses when using snort inline + flexresponse mode?
Processor usage is strictly connected with traffic size, but there is constant RAM usage (in my case 20-30 MB of RAM is used). I had no time to do any traffic latency tests.
thanks afshin
-- Michael "carstein" Melewski | "We have no future bacause our present carstein()7thguard.net | is too volatile. We have only risk mobile: 502 545 913 | management. The spinning of the given JID: carstein()gentoo.pl | moment's scenarios. Pattern recognition. ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------
Current thread:
- Snort inline and iptables afshinlamei (Aug 22)
- Re: Snort inline and iptables Terry Vernon (Aug 22)
- Re: Snort inline and iptables Michal Melewski (Aug 22)
- Re: Snort inline and iptablesy lennu (Aug 23)
- Re: Snort inline and iptablesy Michal Melewski (Aug 23)
- Re: Snort inline and iptablesy lennu (Aug 23)
- Re: Snort inline and iptables Will Metcalf (Aug 22)
- <Possible follow-ups>
- RE: Snort inline and iptables Soi, Dhruv (Aug 22)
- Re: Snort inline and iptables Ratnakumar C H (Aug 23)