Re: Updated IP Blacklisting patch (version 2)

[Martin Roesch <roesch () sourcefire com>]

I haven't tried it with 2.8.5 yet, I'll try it out and see what happens RSN.

Marty

On Tue, Jun 16, 2009 at 2:00 AM, Luis Daniel Lucio
Quiroz<luis.daniel.lucio () gmail com> wrote:
> Le lundi 8 juin 2009 17:12:06, Martin Roesch a écrit :
> > Hey everyone,
> >
> > I had 9 hours to kill flying back to Europe this weekend so I updated
> > the IP Blacklisting patch and it's now available.  You can get it
> > here:
> >
> > http://www.snort.org/users/roesch/code/iplist.patch.v2.tgz
> >
> > What's new?
> >
> > I rewrote the config loader and the event generation code to support
> > named blacklists and loading IP lists from external files.  With these
> > two mods you now get the blacklist name included in the event messages
> > when a banned IP tries to access the network AND you can load however
> > many blacklisted IPs you like, potentially hundreds of thousands (at
> > least).  Check out the README.iplist file that comes with it for
> > config instructions.  Note that whitelists do NOT take names, they're
> > just exceptions to the blacklist anyway.
> >
> > As per usual, this has received minimal testing and NO performance
> > testing.  May cause cramping, bowel discomfort and spontaneous
> > decapitation, use at your own risk, your mileage may vary, etc.  It's
> > a small piece of code but I may have missed something, feel free to
> > send feedback and I'll fix it if you find anything seriously broken.
> >
> > I still haven't done flexresp-style session sniping nor does it load
> > IPv6 addresses yet.  Maybe in v3.
> >
> > Enjoy!
> >
> > Marty
>
> Has tryed with 2.8.5 beta?



-- 
Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616
Sourcefire - Security for the Real World - http://www.sourcefire.com
Snort: Open Source IDP - http://www.snort.org

------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables unlimited
royalty-free distribution of the report engine for externally facing 
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users