Release of snort_inline-1.9.1

[Rob McMillen <rvmcmil () cablespeed com>]

        On behalf of the Honeynet Project, I would like to announce the
release of snort_inline-1.9.1.  This version of snort_inline has been
updated to the latest version of Snort: 1.9.1, with a few
modifications.  You can download it at:

http://project.honeynet.org/papers/honeynet/tools/

        snort_inline takes packets from iptables instead of libpcap.  It
then uses new rule types to help iptables make pass or drop decisions
based on the snort rules format.  These new rule types consist of:

drop - The drop rule type will tell iptables to drop the packet and log it
via usual snort means.

reject - The reject rule type will tell iptables to drop the packet; log
it via usual snort means; and send a TCP reset if the protocol is TCP or
an icmp port unreachable if the protocol is UDP.

sdrop - The sdrop rule type will tell iptables to drop the packet.
Nothing is logged.

        To get you started, Mike Clark <mike () honeynet org> has started a
drop ruleset to stop suspicious traffic from leaving a compromised
Honeypot.  A copy of this ruleset can be found in the rules directory of
the snort_inline-1.9.1 package, but the latest and greatest can always be
found at:

http://project.honeynet.org/papers/honeynet/tools/drop.rules

        Also, in order to ensure a drop rule has precedence over an alert
or log rule, the rule application order has been changed.  The
snort_inline-1.9.1 rule application order is:

->activation->dynamic->drop->sdrop->reject->alert->pass->log

Also, if you don't feel like downloading and compiling source code, take a
look at the HONEYNET SNORT_INLINE TOOLKIT.  This is a statically compiled
snort_inline-1.9.1 binary put together by the Honeynet Project for the
Linux Operating System.  It comes with a set of drop.rules, the
snort_inline binary, a snort-inline rotation shell script, and a good
README.  It can be found at:

http://www.honeynet.org/papers/honeynet/tools/

        For more details on installing, configuring, developing, and
running snort_inline-1.9.1, please read the doc/README.INLINE contained in
the package.

        Feel free to contact me at rvmcmil () cablespeed com if you have any
questions, concerns, or gripes regarding snort_inline-1.9.1.

Rob McMillen
Member of the Honeynet Project



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users