Snort mailing list archives

Previous By Date Next
Previous By Thread Next

Re: Inline IP_Forwarding and other simple questions?

From: "mdpeters" <michael.peters () lazarusalliance com>
Date: Tue, 28 Dec 2004 11:24:08 -0500
Would MySQL logging be done the same way for Snort-inline as it is with regular Snort?
output database: alert, mysql, dbname=snort user=snortuser host=localhost password=snortuserpassword
----- Original Message ----- From: "Will Metcalf" <william.metcalf () gmail com> 
To: "mdpeters" <michael.peters () lazarusalliance com>
Sent: Monday, December 27, 2004 12:04 PM
Subject: Re: [Snort-users] Inline IP_Forwarding and other simple questions?



because, you are not pulling traffic off of the bridge.  You are
pulling traffic out of iptables, via the QUEUE target.  As far as the
rules go, you need to convert alert to drop/sdrop/reject.

Regards,

Will


On Mon, 27 Dec 2004 11:36:10 -0500, mdpeters
<michael.peters () lazarusalliance com> wrote:

One instance for both interfaces or just one like you wrote? How does it
know what interface the bridge is on?


----- Original Message -----
From: "Will Metcalf" <william.metcalf () gmail com>
To: "mdpeters" <michael.peters () lazarusalliance com>
Sent: Monday, December 27, 2004 11:00 AM
Subject: Re: [Snort-users] Inline IP_Forwarding and other simple questions? 

> look at inline readme file under doc in your source.
>
> you were close....
>
> /opt/snort/bin/snort-inline -Q -l /var/log/snort/ -D -c
> /opt/snort/etc/snort_inline.conf
>
> something like that...
>
> Regards,
>
> Will
>
>
> On Mon, 27 Dec 2004 09:46:33 -0500, mdpeters
> <michael.peters () lazarusalliance com> wrote:
>> Right now I have this running:
>>
>> /opt/snort/bin/snort-inline -Q -c /opt/snort/etc/inline1.conf -i >> eth1 -l 
>> /var/log/snort-inline1 -D
>> /opt/snort/bin/snort-inline -Q -c /opt/snort/etc/inline2.conf -i >> eth2 -l 
>> /var/log/snort-inline2 -D
>>
>> I apparently do not understand how inline works.
>>
>> What would the snort-inline command be to work on a transparent bridge
>> snort-inline with iptables?
>>
>> Where can I read up?
>>
>> I appreciate your help!
>>
>> ----- Original Message -----
>> From: "Will Metcalf" <william.metcalf () gmail com>
>> To: "mdpeters" <michael.peters () lazarusalliance com>
>> Sent: Monday, December 27, 2004 8:14 AM
>> Subject: Re: [Snort-users] Inline IP_Forwarding and other simple
>> questions?
>>
>> > neither you would use the -Q switch to tell snort to read from
>> > ip_queue. Then you have to send traffic to snort with iptables with >> > a 
>> > rule like this.
>> >
>> > iptables -A FORWARD -j QUEUE
>> >
>> >
>> > On Mon, 27 Dec 2004 00:06:30 -0500, mdpeters
>> > <michael.peters () lazarusalliance com> wrote:
>> >> Would I need to use the bridge "br0" group interface or the >> >> individual 
>> >> interfaces "eth0' and "eth1" that make up the group for the
>> >> Snort-inline
>> >> start command?
>> >>
>> >> Thanks,
>> >> Michael
>> >>
>> >> ----- Original Message -----
>> >> From: "Will Metcalf" <william.metcalf () gmail com>
>> >> To: "Matt Kettler" <mkettler () evi-inc com>
>> >> Cc: "mdpeters" <michael.peters () lazarusalliance com>;
>> >> <snort-users () lists sourceforge net>
>> >> Sent: Thursday, December 23, 2004 4:43 PM
>> >> Subject: Re: [Snort-users] Inline IP_Forwarding and other simple
>> >> questions?
>> >>
>> >> > Well said, except that drop does not reset the connection.  Using
>> >> > reject will drop and reset the connection.
>> >> >
>> >> > Regards,
>> >> >
>> >> > Will
>> >> >
>> >> > On Thu, 23 Dec 2004 15:21:37 -0500, Matt Kettler
>> >> > <mkettler () evi-inc com>
>> >> > wrote:
>> >> >> At 02:04 PM 12/23/2004, mdpeters wrote:
>> >> >> >Do I need to enable ip_forwarding on for the transparent bridge >> >> >> >to 
>> >> >> >work?
>> >> >>
>> >> >> As I understand it, you explicitly MUST NOT enable >> >> >> ip_forwarding, 
>> >> >> otherwise
>> >> >> your snort-inline is a "pass all".
>> >> >>
>> >> >> >
>> >> >> >Do I need to install ebtables for inline to disrupt traffic or >> >> >> >is 
>> >> >> >iptables, libnet, and libpcap all that I might need?
>> >> >>
>> >> >> AFAIK you don't need ebtables. You do need libipq for inline >> >> >> and 
>> >> >> libnet.
>> >> >> This is how snort-inline attaches to iptables by using libipq
>> >> >> instead
>> >> >> of
>> >> >> using libpcap.
>> >> >>
>> >> >>
>> >> >> >  It is my impression that iptables just firewalls with static
>> >> >> > rules.
>> >> >>
>> >> >> On it's own, yes, but IPTables is VERY extensible via libipq..
>> >> >>
>> >> >> That's where snort-inline comes in. Snort-inline interacts with
>> >> >> iptables.
>> >> >> It doesn't do things like create iptables rules to block >> >> >> packets, 
>> >> >> it
>> >> >> the
>> >> >> whole system becomes an iptables rule, it just happens to be a >> >> >> rule 
>> >> >> that
>> >> >> runs snort instead of some simple expression.
>> >> >>
>> >> >>
>> >> >> >
>> >> >> >Do the snort rules running on the transparent inline snort box
>> >> >> >reset
>> >> >> >the
>> >> >> >traffic that passes through using inline?
>> >> >>
>> >> >> Depends on if you use DROP or SDROP :).. However, inline doesn't
>> >> >> JUST
>> >> >> reset
>> >> >> the traffic.. it also prevents the packet from being forwarded >> >> >> at 
>> >> >> all.
>> >> >> DROP
>> >> >> will also reset, SDROP won't.
>> >> >>
>> >> >> Snort 2.3's inline capacity is a direct port of snort-inline. >> >> >> You 
>> >> >> might
>> >> >> want to check their FAQ for other info:
>> >> >>
>> >> >> http://snort-inline.sourceforge.net/FAQ.html
>> >> >>
>> >> >> -------------------------------------------------------
>> >> >> SF email is sponsored by - The IT Product Guide
>> >> >> Read honest & candid reviews on hundreds of IT Products from >> >> >> real 
>> >> >> users.
>> >> >> Discover which products truly live up to the hype. Start reading
>> >> >> now.
>> >> >> http://productguide.itmanagersjournal.com/
>> >> >> _______________________________________________
>> >> >> Snort-users mailing list
>> >> >> Snort-users () lists sourceforge net
>> >> >> Go to this URL to change user options or unsubscribe:
>> >> >> https://lists.sourceforge.net/lists/listinfo/snort-users
>> >> >> Snort-users list archive:
>> >> >> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>> >> >>
>> >> >
>> >> >
>> >> > -------------------------------------------------------
>> >> > SF email is sponsored by - The IT Product Guide
>> >> > Read honest & candid reviews on hundreds of IT Products from real
>> >> > users.
>> >> > Discover which products truly live up to the hype. Start reading
>> >> > now.
>> >> > http://productguide.itmanagersjournal.com/
>> >> > _______________________________________________
>> >> > Snort-users mailing list
>> >> > Snort-users () lists sourceforge net
>> >> > Go to this URL to change user options or unsubscribe:
>> >> > https://lists.sourceforge.net/lists/listinfo/snort-users
>> >> > Snort-users list archive:
>> >> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>> >> >
>> >>
>> >>
>> >
>>
>>
>








-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/ 
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
Previous By Date Next
Previous By Thread Next

Current thread: