RE: Slow down TCP connections

["pfeito" <pfeito () netcabo pt>]

I don't really have a final purpose, I'm just digging out what proactive
stuff there is out there for Snort. 
I don't need it, I just thought of it, as an example of proactive
functionality and wanted to find out if there is such thing. I guess it is
kind of stupid.... although it could be useful in an snort+honeypot
scenario. Don't really put much though in it.

> Why are you seeking and IDS to do traffic queueing ?
No. That would be like trying to cut a steak with a spoon :P !

> -----Original Message-----
> From: snort-users-admin () lists sourceforge net [mailto:snort-users-
> admin () lists sourceforge net] On Behalf Of Keith W. McCammon
> Sent: domingo, 29 de Agosto de 2004 18:14
> To: snort-users () lists sourceforge net
> Subject: Re: [Snort-users] Slow down TCP connections
>
> > Right know, I've just compiled and installed snort 2.2.0 with flexresp2
> > support. I'm about to test flexresp2 capabilities, but It seems to have
> no
> > support for slowing down TCP connections (i.e. for slowing down TCP
> Scans
> > for instance...)
>
> Why would Snort want to "slow down" a TCP scan?  Snort will catch it,
> and under certain circumstances, flexresp2 can reset those
> connections.  That's pretty much the extent of Snort's involvement.
>
> > Do you know any plug-in that allows Snort to slow down TCP connections
> speed
> > (i.e. resize TCP window size) ?
>
> No.  What would you accomplish by doing this?  Either block the
> traffic or don't.  Slowing it down won't really get you anywhere
> (it'll just take the attacker longer to do the same thing).
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by BEA Weblogic Workshop
> FREE Java Enterprise J2EE developer tools!
> Get your free copy of BEA WebLogic Workshop 8.1 today.
> http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users




-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users