Snort mailing list archives
Re: Inline IP_Forwarding and other simple questions?
From: Will Metcalf <william.metcalf () gmail com>
Date: Thu, 23 Dec 2004 15:43:47 -0600
Well said, except that drop does not reset the connection. Using reject will drop and reset the connection. Regards, Will On Thu, 23 Dec 2004 15:21:37 -0500, Matt Kettler <mkettler () evi-inc com> wrote:
At 02:04 PM 12/23/2004, mdpeters wrote:Do I need to enable ip_forwarding on for the transparent bridge to work?As I understand it, you explicitly MUST NOT enable ip_forwarding, otherwise your snort-inline is a "pass all".Do I need to install ebtables for inline to disrupt traffic or is iptables, libnet, and libpcap all that I might need?AFAIK you don't need ebtables. You do need libipq for inline and libnet. This is how snort-inline attaches to iptables by using libipq instead of using libpcap.It is my impression that iptables just firewalls with static rules.On it's own, yes, but IPTables is VERY extensible via libipq.. That's where snort-inline comes in. Snort-inline interacts with iptables. It doesn't do things like create iptables rules to block packets, it the whole system becomes an iptables rule, it just happens to be a rule that runs snort instead of some simple expression.Do the snort rules running on the transparent inline snort box reset the traffic that passes through using inline?Depends on if you use DROP or SDROP :).. However, inline doesn't JUST reset the traffic.. it also prevents the packet from being forwarded at all. DROP will also reset, SDROP won't. Snort 2.3's inline capacity is a direct port of snort-inline. You might want to check their FAQ for other info: http://snort-inline.sourceforge.net/FAQ.html ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Inline IP_Forwarding and other simple questions? mdpeters (Dec 23)
- Re: Inline IP_Forwarding and other simple questions? Matt Kettler (Dec 23)
- Re: Inline IP_Forwarding and other simple questions? Will Metcalf (Dec 23)
- Message not available
- Message not available
- Message not available
- Message not available
- Message not available
- Message not available
- Re: Inline IP_Forwarding and other simple questions? mdpeters (Dec 28)
- Re: Inline IP_Forwarding and other simple questions? Will Metcalf (Dec 28)
- Message not available
- Re: Inline IP_Forwarding and other simple questions? Will Metcalf (Dec 28)
- Re: Re: Inline IP_Forwarding and other simple questions? mdpeters (Dec 30)
- Re: Re: Inline IP_Forwarding and other simple questions? Will Metcalf (Dec 30)
- Re: Re: Inline IP_Forwarding and other simple questions? mdpeters (Dec 30)
- Message not available
- Message not available
- Message not available
- Message not available
- Re: Re: Inline IP_Forwarding and other simple questions? mdpeters (Dec 31)
- Re: Inline IP_Forwarding and other simple questions? Will Metcalf (Dec 23)
- Re: Inline IP_Forwarding and other simple questions? Matt Kettler (Dec 23)
- Message not available
- Message not available
- Message not available
- Message not available
- Message not available
- Message not available
- Re: Inline IP_Forwarding and other simple questions? mdpeters (Dec 28)
- Re: Inline IP_Forwarding and other simple questions? Will Metcalf (Dec 28)