Re: AW: Snort& Intrusion Prevention

[Matt Kettler <mkettler () evi-inc com>]

At 05:42 AM 6/3/2004, Maetzky, Steffen (Extern) wrote:
> How does flexresp/flexresp2 communicate if it isn't a kind of inline-ids?

How does your PC communicate with other PCs on your network? It just sends 
packets.

Flexresp is no more in-line than your desktop pc.


In-line implies traffic to your lan MUST go through the snort box.

Flexresp has no through requirements. Normal traffic goes AROUND it.

>  iface (promisc) ------- snort ------- os?
> (reset on receiver-side)

Flexresp generally works in the above configuration. It just sends resets 
out the sniffing interface. 



-------------------------------------------------------
This SF.Net email is sponsored by the new InstallShield X.
> From Windows to Linux, servers to mobile, InstallShield X is the one
installation-authoring solution that does it all. Learn more and
evaluate today! http://www.installshield.com/Dev2Dev/0504
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users