Re: Blocking attacking IP address for some time using Snort and PIX

[Matt Kettler <mkettler () evi-inc com>]

At 07:49 PM 10/2/2003, kanwal jeet wrote:
> I have implemented snort and it is working fine. The problem i have is 
> that it is not able to block the attacking IP address. It would just log 
> it in mysql.
>
> I have Pix firewall and i want IDS to instruct the PIX firewall to drop 
> all traffic coming from the source IP of the attacker and then remove the 
> ban after a period of time has expired.
>
> Is it possible with snort ?  i know it is possible with Cisco IDS.
> Can i accomplish the same with Snort ?

Not with snort itself. Snort all on it's own is nothing more that a simple 
IDS. It doesn't do much of anything except log events (well, ok flexresp is 
part of snort too, but it's an optional part)

However there is a tool out there that interacts with the snort logging and 
can reconfigure a cisco pix...

Snortsam is the answer to what you want my friend.

http://www.snortsam.net/



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users