Snort mailing list archives
RE: Country blocking?
From: "Donofrio, Lewis" <donofrio () umich edu>
Date: Tue, 18 Jan 2005 09:30:12 -0500
Anything from RIPE.NET could be blocked as far as I can tell.... --just my 2 cents. ______________________________________________________________________ Lewis Donofrio () umich edu College of Literature, Science, & Arts 1007 East Huron, Room 201, BetaID:243340 Cell: (734) 323-8776 Ann Arbor,MI 48104-1690 www.umich.edu/~donofrio Fax: (734) 647-8333 ---------------------------------------------------------------------- () ascii ribbon campaign - against html mail /\ [http://arc.pasp.de/] -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Alex Kirk Sent: Tuesday, January 18, 2005 8:56 AM To: mdpeters Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] Country blocking? That's probably a task that's better suited for your firewall, if you're just dropping all connections from a country, irrespective of what they contain. That being said, though, it can be difficult to block based on geographic region, let alone a specific country. IP address ranges are somewhat fluid, and geolocation is still an inexact science. Unless I'm unaware of some new technology out there, chances are good that your attempt to block by country will result in some connections from it still getting through, along with the blocking of some things that aren't from that country -- especially since there's nothing in most packets that associate them with a specific country. I mean, it's not like you could to try to use Snort to block anything that contained the Chinese character set, since you'd miss messages coming from China in English, but zap messages in Chinese from, say, Cambodia, Vietnam, or even America. It gets worse when dealing with straight TCP/IP -- you wouldn't even have that kind of a clue. If anyone else has a solution to this, I'm all ears, but I have a feeling you're out of luck here. Alex Kirk Research Analyst Sourcefire, Inc.
Could anyone advise me on how to block a large IP address space using Snort-inline? For example, I would like to drop all connections originating from China.
------------------------------------------------------- The SF.Net email is sponsored by: Beat the post-holiday blues Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek. It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- The SF.Net email is sponsored by: Beat the post-holiday blues Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek. It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Country blocking? mdpeters (Jan 19)
- Re: Country blocking? Alex Kirk (Jan 19)
- Re: Country blocking? Jose Maria Lopez (Jan 19)
- <Possible follow-ups>
- RE: Country blocking? Donofrio, Lewis (Jan 19)
- RE: Country blocking? Cilin (Jan 19)
- Message not available
- RE: Country blocking? Matt Kettler (Jan 19)
- RE: Country blocking? Theodore Stout (Jan 19)
- Re: Country blocking? D.P.Round (Jan 19)
- Re: Country blocking? Wally Bedford (Jan 19)
- Re: Country blocking? Alex Butcher, ISC/ISYS (Jan 19)
- Re: Country blocking? Jose Maria Lopez (Jan 19)