Snort mailing list archives
Re: Slow down TCP connections
From: Jose Maria Lopez <jkerouac () eresmas com>
Date: 29 Aug 2004 21:45:16 +0200
El dom, 29 de 08 de 2004 a las 18:57, pfeito escribió:
Hi Guys, I'm searching for pro-active plug-ins for Snort. Right know, I've just compiled and installed snort 2.2.0 with flexresp2 support. I'm about to test flexresp2 capabilities, but It seems to have no support for slowing down TCP connections (i.e. for slowing down TCP Scans for instance...) Do you know any plug-in that allows Snort to slow down TCP connections speed (i.e. resize TCP window size) ? Thanks, -pfeito
Wouldn't it be more useful to use iptables or iproute2 for this work? With iptables you can do something like: iptables -A INPUT -i <if> -p tcp --syn -m limit --limit 20/s -j ACCEPT (accept 20 SYN connections per second, you can also use the burst option to make it more suitable) and with iproute2 you can use the QOS capabilities of the system to limit the number of TCP connections. This is the correct option to slow down the number of TCP connections, but it's a bit complicated. You can read the Advanced Routing HOWTO that explains it all very deeply. -- Jose Maria Lopez Hernandez Director Tecnico de bgSEC jkerouac () bgsec com bgSEC Seguridad y Consultoria de Sistemas Informaticos http://www.bgsec.com ESPAÑA The only people for me are the mad ones -- the ones who are mad to live, mad to talk, mad to be saved, desirous of everything at the same time, the ones who never yawn or say a commonplace thing, but burn, burn, burn like fabulous yellow Roman candles. -- Jack Kerouac, "On the Road" ------------------------------------------------------- This SF.Net email is sponsored by BEA Weblogic Workshop FREE Java Enterprise J2EE developer tools! Get your free copy of BEA WebLogic Workshop 8.1 today. http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- thanks guys! Jeremy Kocimski (Aug 29)
- Slow down TCP connections pfeito (Aug 29)
- Re: Slow down TCP connections Keith W. McCammon (Aug 29)
- RE: Slow down TCP connections pfeito (Aug 29)
- Re: Slow down TCP connections Jeff Nathan (Aug 29)
- Re: Slow down TCP connections James Edwards (Aug 29)
- RE: Slow down TCP connections Jim Hendrick (Aug 29)
- RE: Slow down TCP connections pfeito (Aug 29)
- Re: Slow down TCP connections Jose Maria Lopez (Aug 31)
- Re: Slow down TCP connections Keith W. McCammon (Aug 29)
- Slow down TCP connections pfeito (Aug 29)