Snort & Firewall

[Stephen Torri <storri () ameritech net>]

I have one firewall protecting a home network connected via DSL (PPPoE).
I have a few questions about using snort.

1) Can I use it on the same machine as the firewall? Is there a security
risk running the outside NIC in promiscuous mode?

2) If I can which will pick up an incoming packet first, snort or the
firewall (ipchains)?

3) I believe I read that snort can perform actions depending upon the
outcome of a rule. For example a rule to protect against Code Red worm
that was in the news is tripped. Can it add a rule to the firewall to
block at host making the attack?

Stephen


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users