Snort mailing list archives
Re: A question now that I have nfq working
From: Graham Murray <graham () gmurray org uk>
Date: Tue, 15 Apr 2014 14:52:08 +0100
James Lay <jlay () slave-tothe-box net> writes:
Well this has been an interesting exercise. Basically it boils down to this: either a packet in the Snort nfqueue is accepted and sent on, or it's dropped. Now dropped is self evident, but "accepted and sent on" means exactly that...sent up the stack, NOT to the next rule in the table..the packet is treated just like it had hit an iptables ACCEPT rule.
Maybe the solution to that would be to put the NFQ in the mangle table PREROUTING chain rather than the filter table INPUT chain. That way if snort accepted (via a verdict of NF_ACCEPT) the packet would traverse the 'normal' filter rules. ------------------------------------------------------------------------------ Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive new guide to graph databases and their applications. Written by three acclaimed leaders in the field, this first edition is now available. Download your free book today! http://p.sf.net/sfu/NeoTech _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- A question now that I have nfq working James Lay (Apr 08)
- Re: A question now that I have nfq working James Lay (Apr 08)
- Re: A question now that I have nfq working James Lay (Apr 10)
- Re: A question now that I have nfq working James Lay (Apr 15)
- Re: A question now that I have nfq working Graham Murray (Apr 15)
- Re: A question now that I have nfq working James Lay (Apr 10)
- Re: A question now that I have nfq working James Lay (Apr 08)