Re: Country blocking?

[Alex Kirk <alex.kirk () sourcefire com>]

That's probably a task that's better suited for your firewall, if you're 
just dropping all connections from a country, irrespective of what they 
contain.

That being said, though, it can be difficult to block based on 
geographic region, let alone a specific country. IP address ranges are 
somewhat fluid, and geolocation is still an inexact science. Unless I'm 
unaware of some new technology out there, chances are good that your 
attempt to block by country will result in some connections from it 
still getting through, along with the blocking of some things that 
aren't from that country -- especially since there's nothing in most 
packets that associate them with a specific country. I mean, it's not 
like you could to try to use Snort to block anything that contained the 
Chinese character set, since you'd miss messages coming from China in 
English, but zap messages in Chinese from, say, Cambodia, Vietnam, or 
even America. It gets worse when dealing with straight TCP/IP -- you 
wouldn't even have that kind of a clue.

If anyone else has a solution to this, I'm all ears, but I have a 
feeling you're out of luck here.

Alex Kirk
Research Analyst
Sourcefire, Inc.

> Could anyone advise me on how to block a large IP address space using 
> Snort-inline? For example, I would like to drop all connections 
> originating from China.



-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users