Re: Packet drop functionality with snort

[Alberto Gonzalez <electron () wwjh net>]

> hi all ,

{ sigh... }

> I am using snort for the purpose it is meant to
> serve(IDS) .I would like to know how can snort be
> configured
> or used to drop packets .
> My setup comprises of 5 machines connected via a hub,
> with snort installed on one of the boxes.
> I am running low on time and would like to add this
> vital functionality  most definitely ,so any ideas ,
> comments on the same idea would be most appreciated.

There are a few programs out there that will do this for you. You have 
snortsam[1] hogwash[2] and or snort-inline[3]. I suggest using these over 
flexible response with snort.

> regards,
> rajat

 Cheers,
 Alberto Gonzalez

[1] - http://www.snortsam.net
[2] - http://hogwash.sourceforge.net
[3] - http://www.snort.org/dl/contrib/patches/inline/snort-inline.tgz

-- 
"Success comes to the person who does today, what you are thinking of doing tomorrow." 




-------------------------------------------------------
This SF.net email is sponsored by:Crypto Challenge is now open! 
Get cracking and register here for some mind boggling fun and 
the chance of winning an Apple iPod:
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0031en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users