Re: DOS in Snort?

[Erick Mechler <emechler () techometer net>]

:: Overall it took about 30 minuets to clear up everything. This is an OS issue and
:: not a snort issue right? Is there a way to limit the number of alerts? Couldn't
:: any snort box not logging to a database be susceptible to a DOS in this manner?

The only way this could be used in a DoS against a snort sensor is if you 
have neglected to properly partition your disks, and you manage to fill up 
an important filesystem on your sensor.  For instance, if you fill up /, 
some OS's might have a problem with that.  Additionally, you can bring a 
Solaris system to its knees if you fill up /tmp.

Cheers - Erick


-------------------------------------------------------
This SF.net email is sponsored by: SlickEdit Inc. Develop an edge.
The most comprehensive and flexible code editor you can use.
Code faster. C/C++, C#, Java, HTML, XML, many more. FREE 30-Day Trial.
www.slickedit.com/sourceforge
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users