Snort mailing list archives
Re: List of Snort IP Address Ranges
From: Kevin Wong <kevin () coretechx com>
Date: Sat, 9 Mar 2019 22:41:30 -0800
I was trying to avoid opening up to the entire Amazon S3 space because that could mean data can be siphoned off by spinning up an instance. I was hoping Snort had a deterministic list of IPs they load balance between. I could monitor the system closely like you said but this same system would be doing the monitoring. That sounds like a easy way for somebody to cover their tracks if the server got owned. On Sat, Mar 9, 2019 at 9:55 PM Jason Hellenthal <jhellenthal () dataix net> wrote:
Look up AWS S3 IP address space. It’s quite large but not a product of snort. Kept track of where ? Idk but allowing 443 outbound to those you come across may be a little intimidating to keep up with for maintenance sake. pass out any port 443 to any from <a source ip controller> keep-state Then if required audit the logins and connections from that system. Best of luck. -- J. Hellenthal The fact that there's a highway to Hell but only a stairway to Heaven says a lot about anticipated traffic volume. On Mar 9, 2019, at 22:59, Kevin Wong <kevin () coretechx com> wrote: My server has to go through firewalls and a proxy before downloading the latest rules from snort.org. When using wget I see that the server is trying to contact Amazon S3 and I think that is breaking my download since " snort-org-site.s3.amazonaws.com" is load-balanced behind many IP addresses. Is there a list of IP's that I can open up for my firewall and proxy to allow traffic? Thanks _______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: snort-users-leave () lists snort org Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette --
Kevin Wong CoreTechx IT Solutions (800) 264-1304 www.coretechx.com
_______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: snort-users-leave () lists snort org Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
Current thread:
- List of Snort IP Address Ranges Kevin Wong (Mar 09)
- Re: List of Snort IP Address Ranges Jason Hellenthal via Snort-users (Mar 09)
- Re: List of Snort IP Address Ranges Kevin Wong (Mar 09)
- Re: List of Snort IP Address Ranges Jason Hellenthal via Snort-users (Mar 09)