Snort mailing list archives
Re: Re: Inline IP_Forwarding and other simple questions?
From: "mdpeters" <michael.peters () lazarusalliance com>
Date: Sun, 2 Jan 2005 09:35:40 -0500
This is my startup for snort-inline currently is:opt/snort-inline/bin/snort-inline -Qc /opt/snort-inline/etc/inline.conf -l /var/log/snort-inline -D
Do I need to use the "-i" option? The bridge group in my case is "br0" comprised of "eth1" and "eth2". Would I need to set this up like this?
opt/snort-inline/bin/snort-inline -Qc /opt/snort-inline/etc/inline.conf -i br0 -l /var/log/snort-inline -D
----- Original Message ----- From: "Will Metcalf" <william.metcalf () gmail com>
To: "mdpeters" <michael.peters () lazarusalliance com> Sent: Thursday, December 30, 2004 2:15 PMSubject: Re: [Snort-users] Re: Inline IP_Forwarding and other simple questions?
using a 2.6 kernel????? change config checksum_mode: all to config checksum_mode: none let me know if that fixes your problem On Thu, 30 Dec 2004 13:07:13 -0500, mdpeters <michael.peters () lazarusalliance com> wrote:var IPS_NET 65.89.128.128/27 var EXTERNAL_NET any var SMTP_SERVERS any var TELNET_SERVERS any var HTTP_SERVERS any var SQL_SERVERS any var HTTP_PORTS 80 var SHELLCODE_PORTS !80 var ORACLE_PORTS 1521 config checksum_mode: all var RULE_PATH /opt/snort-inline/rules/ips config layer2resets: 00:04:23:AD:ED:BA preprocessor flow: stats_interval 0 hash 2 preprocessor stream4: disable_evasion_alerts,iptablesnewmark,iptablesestmark,forceiptstate preprocessor stream4_reassemble: both # preprocessor clamav: ports all !22 !443, toclientonly, dbdir /usr/share/clamav preprocessor http_inspect: global iis_unicode_map unicode.map 1252preprocessor http_inspect_server: server default profile all ports { 80 80808180 } oversize_dir_length 500 preprocessor rpc_decode: 111 32771 preprocessor bo preprocessor telnet_decode output alert_full: snort-full output alert_fast: snort-fast output alert_syslog: LOG_AUTH LOG_ALERToutput database: alert, mysql, user=user password=userpassword dbname=snorthost=localhost sensor_name=INLINE output log_tcpdump: tcpdump.log include classification.config include reference.config include $RULE_PATH/ips.rules ----- Original Message ----- From: "Will Metcalf" <william.metcalf () gmail com> To: "mdpeters" <michael.peters () lazarusalliance com> Sent: Thursday, December 30, 2004 12:53 PM Subject: Re: [Snort-users] Re: Inline IP_Forwarding and other simple questions? > send me a sanitized version of your snort.conf. > > Regards, > > Will > > > On Thu, 30 Dec 2004 12:40:56 -0500, mdpeters > <michael.peters () lazarusalliance com> wrote: >> I tried the "config layer2resets: 00:04:23:AD:ED:BA" instead of the >> "config >> layer2resets:" which seems to work. >> >> >> ----- Original Message ----- >> From: "Will Metcalf" <william.metcalf () gmail com> >> To: "mdpeters" <michael.peters () lazarusalliance com> >> Cc: "Michael D. Peters" <mdpeters () lazarusalliance com>; >> <snort-users () lists sourceforge net> >> Sent: Thursday, December 30, 2004 11:06 AM >> Subject: Re: [Snort-users] Re: Inline IP_Forwarding and other simple >> questions? >> >> > Just for grins try to leave the default in there and see if it still >> > dies. if it does send me a core dump. >> > >> > Regards, >> > >> > Will >> > >> > >> > On Thu, 30 Dec 2004 09:50:02 -0500, mdpeters >> > <michael.peters () lazarusalliance com> wrote: >> >> I am trying to set up Snort-inline. When I enable "config >> >> layer2resets:" >> >> it >> >> dies. Do I need to include the MAC of the bridge group, in my case, >> >> 00:04:23:AD:ED:BA to get it to reset connections with IPTABLES? >> >> >> >> config layer2resets: 00:04:23:AD:ED:BA >> >> >> >> eth0 00:04:23:AD:ED:BA >> >> eth1 00:04:23:AD:ED:BB >> >> br0 00:04:23:AD:ED:BA >> >>>> >> Also, concerning rules for Snort-inline. Do I take to rules >> >> included>> >> in >> >> the >> >> tarball and modify the *.rules to something like this: >> >>>> >> drop icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP ISS >> >> Pinger";>> >> itype:8; content:"ISSPNGRQ"; depth:32; reference:arachnids,158; >> >> classtype:attempted-recon; sid:465; rev:3;) >> >> >> >> or >> >>>> >> sdrop icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP ISS >> >> Pinger";>> >> itype:8; content:"ISSPNGRQ"; depth:32; reference:arachnids,158; >> >> classtype:attempted-recon; sid:465; rev:3;) >> >> >> >> or >> >>>> >> reject icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP ISS >> >> Pinger";>> >> itype:8; content:"ISSPNGRQ"; depth:32; reference:arachnids,158; >> >> classtype:attempted-recon; sid:465; rev:3;) >> >> >> >> or >> >>>> >> drop icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"ICMP ISS >> >> Pinger";>> >> itype:8; content:"ISSPNGRQ"; depth:32; reference:arachnids,158; >> >> classtype:attempted-recon; sid:465; rev:3;) >> >> >> >> or something like these? >> >> >> >> Thanks, >> >> >> >> Michael >> >> >> >> ----- Original Message ----- >> >> From: "Will Metcalf" <william.metcalf () gmail com> >> >> To: "Michael D. Peters" <mdpeters () lazarusalliance com> >> >> Cc: "mdpeters" <michael.peters () lazarusalliance com>; >> >> <snort-users () lists sourceforge net> >> >> Sent: Tuesday, December 28, 2004 6:16 PM >> >> Subject: [Snort-users] Re: Inline IP_Forwarding and other simple >> >> questions? >> >>>> >> >> What I am asking is since this uses IPTABLES, should I just set >> >> >> up>> >> >> permanent>> >> >> "firewall type" IPTABLE rules and then use the modified snort >> >> >> rules>> >> >> to >> >> >> take >> >> >> care of the resets, drops, etc? >> >> > >> >> > Yes >> >> > >> >> > >> >> > On Tue, 28 Dec 2004 18:02:12 -0500, Michael D. Peters >> >> > <mdpeters () lazarusalliance com> wrote:>> >> >> What I am asking is since this uses IPTABLES, should I just set >> >> >> up>> >> >> permanent>> >> >> "firewall type" IPTABLE rules and then use the modified snort >> >> >> rules>> >> >> to >> >> >> take >> >> >> care of the resets, drops, etc? >> >> >> >> >> >> >> >> >> Will Metcalf writes: >> >> >>>> >> >> >> If I have something like this: <GATEWAY-ROUTER> connected >> >> >> >> to>> >> >> >> <FIREWALL> >> >> >> >> connected to <SNORT_INLINE> connected to <NETWORK HUB OR >> >> >> >> SWITCH>. >> >> >> >> Would I>> >> >> >> set the "var HOME_NET any" to "var HOME_NET >> >> >> >> nnn.nnn.nnn.nnn/xx?>> >> >> > >> >> >> > Yes >> >> >> > >> >> >> >> Do I need to make a startup script for IPTABLE rules or do I >> >> >> >> rely >> >> >> >> on >> >> >> >> drop.rules or both? I'm inclined to think that the firewall >> >> >> >> rules >> >> >> >> will >> >> >> >> be >> >> >> >> essentially duplicated with IPTABLES and the drop.rules >> >> >> >> interactively >> >> >> >> supplement the IPTABLES. >> >> >> >>> >> >> > I'm not really sure what you are asking for here...... >> >> >> > Usually>> >> >> > it >> >> >> > is>> >> >> > a good idea to have a couple of iptables rules to check state >> >> >> > for>> >> >> > tcp >> >> >> > state etc. Just off the top of my head..... >> >> >> > >> >> >> > iptables -P FORWARD DROP >> >> >> > iptables -A FORWARD -p tcp --syn -m state --state NEW -j QUEUE >> >> >> > iptables -A FORWARD -p tcp -m state --state >> >> >> > RELATED,ESTABLISHED -j >> >> >> > QUEUE >> >> >> > iptables -A FORWARD -p udp -j QUEUE >> >> >> > iptables -A FORWARD -p icmp -j QUEUE >> >> >> >>> >> >> >>Would MySQL logging be done the same way for Snort-inline as >> >> >> >>it>> >> >> >>is >> >> >> >>with >> >> >> >>regular Snort? >> >> >> >> >> >> >> >>output database: alert, mysql, dbname=snort user=snortuser >> >> >> >>host=localhost >> >> >> >>password=snortuserpassword >> >> >> > >> >> >> > Yes >> >> >> > >> >> >> > Regards, >> >> >> > >> >> >> > Will >> >> >> > >> >> >> > >> >> >> > >> >> >> > >> >> >> > On Tue, 28 Dec 2004 10:58:28 -0500, mdpeters >> >> >> > <michael.peters () lazarusalliance com> wrote:>> >> >> >> Concerning the snort-inline.conf file, are the "var" >> >> >> >> statements>> >> >> >> relevant? >> >> >> >> Should I specify the network and subnet that the snort-inline >> >> >> >> box >> >> >> >> runs >> >> >> >> on? >> >> >> >>>> >> >> >> If I have something like this: <GATEWAY-ROUTER> connected >> >> >> >> to>> >> >> >> <FIREWALL> >> >> >> >> connected to <SNORT_INLINE> connected to <NETWORK HUB OR >> >> >> >> SWITCH>. >> >> >> >> Would I>> >> >> >> set the "var HOME_NET any" to "var HOME_NET >> >> >> >> nnn.nnn.nnn.nnn/xx?>> >> >> >> >> >> >> >> Do I need to make a startup script for IPTABLE rules or do I >> >> >> >> rely >> >> >> >> on >> >> >> >> drop.rules or both? I'm inclined to think that the firewall >> >> >> >> rules >> >> >> >> will >> >> >> >> be >> >> >> >> essentially duplicated with IPTABLES and the drop.rules >> >> >> >> interactively >> >> >> >> supplement the IPTABLES. >> >> >> >> >> >> >> >> Thank you for the continued education and assistance. :) >> >> >> >> >> >> >> >> ----- Original Message ----- >> >> >> >> From: "Will Metcalf" <william.metcalf () gmail com> >> >> >> >> To: "mdpeters" <michael.peters () lazarusalliance com> >> >> >> >> Sent: Monday, December 27, 2004 12:04 PM>> >> >> >> Subject: Re: [Snort-users] Inline IP_Forwarding and other >> >> >> >> simple>> >> >> >> questions? >> >> >> >>>> >> >> >> > because, you are not pulling traffic off of the bridge. >> >> >> >> > You>> >> >> >> > are>> >> >> >> > pulling traffic out of iptables, via the QUEUE target. As >> >> >> >> > far>> >> >> >> > as >> >> >> >> > the >> >> >> >> > rules go, you need to convert alert to drop/sdrop/reject. >> >> >> >> > >> >> >> >> > Regards, >> >> >> >> > >> >> >> >> > Will >> >> >> >> > >> >> >> >> > >> >> >> >> > On Mon, 27 Dec 2004 11:36:10 -0500, mdpeters >> >> >> >> > <michael.peters () lazarusalliance com> wrote:>> >> >> >> >> One instance for both interfaces or just one like you >> >> >> >> >> wrote?>> >> >> >> >> How >> >> >> >> >> does it >> >> >> >> >> know what interface the bridge is on? >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> ----- Original Message ----- >> >> >> >> >> From: "Will Metcalf" <william.metcalf () gmail com> >> >> >> >> >> To: "mdpeters" <michael.peters () lazarusalliance com> >> >> >> >> >> Sent: Monday, December 27, 2004 11:00 AM >> >> >> >> >> Subject: Re: [Snort-users] Inline IP_Forwarding and other >> >> >> >> >> simple >> >> >> >> >> questions? >> >> >> >> >> >> >> >> >> >> > look at inline readme file under doc in your source. >> >> >> >> >> > >> >> >> >> >> > you were close.... >> >> >> >> >> > >> >> >> >> >> > /opt/snort/bin/snort-inline -Q -l /var/log/snort/ -D -c >> >> >> >> >> > /opt/snort/etc/snort_inline.conf >> >> >> >> >> > >> >> >> >> >> > something like that... >> >> >> >> >> > >> >> >> >> >> > Regards, >> >> >> >> >> > >> >> >> >> >> > Will >> >> >> >> >> > >> >> >> >> >> > >> >> >> >> >> > On Mon, 27 Dec 2004 09:46:33 -0500, mdpeters >> >> >> >> >> > <michael.peters () lazarusalliance com> wrote: >> >> >> >> >> >> Right now I have this running: >> >> >> >> >> >> >> >> >> >> >> >> /opt/snort/bin/snort-inline -Q -c >> >> >> >> >> >> /opt/snort/etc/inline1.conf -i >> >> >> >> >> >> eth1 -l >> >> >> >> >> >> /var/log/snort-inline1 -D >> >> >> >> >> >> /opt/snort/bin/snort-inline -Q -c >> >> >> >> >> >> /opt/snort/etc/inline2.conf -i >> >> >> >> >> >> eth2 -l >> >> >> >> >> >> /var/log/snort-inline2 -D >> >> >> >> >> >> >> >> >> >> >> >> I apparently do not understand how inline works. >> >> >> >> >> >> >> >> >> >> >> >> What would the snort-inline command be to work on a >> >> >> >> >> >> transparent >> >> >> >> >> >> bridge >> >> >> >> >> >> snort-inline with iptables? >> >> >> >> >> >> >> >> >> >> >> >> Where can I read up? >> >> >> >> >> >> >> >> >> >> >> >> I appreciate your help! >> >> >> >> >> >> >> >> >> >> >> >> ----- Original Message ----- >> >> >> >> >> >> From: "Will Metcalf" <william.metcalf () gmail com> >> >> >> >> >> >> To: "mdpeters" <michael.peters () lazarusalliance com> >> >> >> >> >> >> Sent: Monday, December 27, 2004 8:14 AM>> >> >> >> >> >> Subject: Re: [Snort-users] Inline IP_Forwarding and >> >> >> >> >> >> other>> >> >> >> >> >> simple >> >> >> >> >> >> questions? >> >> >> >> >> >> >> >> >> >> >> >> > neither you would use the -Q switch to tell snort to >> >> >> >> >> >> > read >> >> >> >> >> >> > from>> >> >> >> >> >> > ip_queue. Then you have to send traffic to snort >> >> >> >> >> >> > with>> >> >> >> >> >> > iptables with >> >> >> >> >> >> > a >> >> >> >> >> >> > rule like this. >> >> >> >> >> >> > >> >> >> >> >> >> > iptables -A FORWARD -j QUEUE >> >> >> >> >> >> > >> >> >> >> >> >> > >> >> >> >> >> >> > On Mon, 27 Dec 2004 00:06:30 -0500, mdpeters >> >> >> >> >> >> > <michael.peters () lazarusalliance com> wrote:>> >> >> >> >> >> >> Would I need to use the bridge "br0" group interface >> >> >> >> >> >> >> or>> >> >> >> >> >> >> the >> >> >> >> >> >> >> individual>> >> >> >> >> >> >> interfaces "eth0' and "eth1" that make up the group >> >> >> >> >> >> >> for>> >> >> >> >> >> >> the >> >> >> >> >> >> >> Snort-inline >> >> >> >> >> >> >> start command? >> >> >> >> >> >> >> >> >> >> >> >> >> >> Thanks, >> >> >> >> >> >> >> Michael >> >> >> >> >> >> >> >> >> >> >> >> >> >> ----- Original Message ----- >> >> >> >> >> >> >> From: "Will Metcalf" <william.metcalf () gmail com> >> >> >> >> >> >> >> To: "Matt Kettler" <mkettler () evi-inc com> >> >> >> >> >> >> >> Cc: "mdpeters" <michael.peters () lazarusalliance com>; >> >> >> >> >> >> >> <snort-users () lists sourceforge net> >> >> >> >> >> >> >> Sent: Thursday, December 23, 2004 4:43 PM >> >> >> >> >> >> >> Subject: Re: [Snort-users] Inline IP_Forwarding and >> >> >> >> >> >> >> other >> >> >> >> >> >> >> simple >> >> >> >> >> >> >> questions? >> >> >> >> >> >> >> >> >> >> >> >> >> >> > Well said, except that drop does not reset the >> >> >> >> >> >> >> > connection. >> >> >> >> >> >> >> > Using >> >> >> >> >> >> >> > reject will drop and reset the connection. >> >> >> >> >> >> >> > >> >> >> >> >> >> >> > Regards, >> >> >> >> >> >> >> > >> >> >> >> >> >> >> > Will >> >> >> >> >> >> >> > >> >> >> >> >> >> >> > On Thu, 23 Dec 2004 15:21:37 -0500, Matt Kettler >> >> >> >> >> >> >> > <mkettler () evi-inc com> >> >> >> >> >> >> >> > wrote: >> >> >> >> >> >> >> >> At 02:04 PM 12/23/2004, mdpeters wrote: >> >> >> >> >> >> >> >> >Do I need to enable ip_forwarding on for the >> >> >> >> >> >> >> >> >transparent >> >> >> >> >> >> >> >> >bridge >> >> >> >> >> >> >> >> >to >> >> >> >> >> >> >> >> >work? >> >> >> >> >> >> >> >>>> >> >> >> >> >> >> >> As I understand it, you explicitly MUST NOT >> >> >> >> >> >> >> >> enable>> >> >> >> >> >> >> >> ip_forwarding, >> >> >> >> >> >> >> >> otherwise >> >> >> >> >> >> >> >> your snort-inline is a "pass all". >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >>> >> >> >> >> >> >> >> >Do I need to install ebtables for inline to >> >> >> >> >> >> >> >> >disrupt>> >> >> >> >> >> >> >> >traffic or >> >> >> >> >> >> >> >> >is >> >> >> >> >> >> >> >> >iptables, libnet, and libpcap all that I might >> >> >> >> >> >> >> >> >need? >> >> >> >> >> >> >> >>>> >> >> >> >> >> >> >> AFAIK you don't need ebtables. You do need >> >> >> >> >> >> >> >> libipq>> >> >> >> >> >> >> >> for >> >> >> >> >> >> >> >> inline >> >> >> >> >> >> >> >> and >> >> >> >> >> >> >> >> libnet. >> >> >> >> >> >> >> >> This is how snort-inline attaches to iptables by >> >> >> >> >> >> >> >> using >> >> >> >> >> >> >> >> libipq >> >> >> >> >> >> >> >> instead >> >> >> >> >> >> >> >> of >> >> >> >> >> >> >> >> using libpcap. >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >>>> >> >> >> >> >> >> >> > It is my impression that iptables just >> >> >> >> >> >> >> >> > firewalls>> >> >> >> >> >> >> >> > with >> >> >> >> >> >> >> >> > static >> >> >> >> >> >> >> >> > rules. >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> On it's own, yes, but IPTables is VERY extensible >> >> >> >> >> >> >> >> via >> >> >> >> >> >> >> >> libipq.. >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> That's where snort-inline comes in. Snort-inline >> >> >> >> >> >> >> >> interacts >> >> >> >> >> >> >> >> with >> >> >> >> >> >> >> >> iptables.>> >> >> >> >> >> >> >> It doesn't do things like create iptables rules >> >> >> >> >> >> >> >> to>> >> >> >> >> >> >> >> block >> >> >> >> >> >> >> >> packets, >> >> >> >> >> >> >> >> it >> >> >> >> >> >> >> >> the >> >> >> >> >> >> >> >> whole system becomes an iptables rule, it just >> >> >> >> >> >> >> >> happens >> >> >> >> >> >> >> >> to >> >> >> >> >> >> >> >> be a >> >> >> >> >> >> >> >> rule >> >> >> >> >> >> >> >> that >> >> >> >> >> >> >> >> runs snort instead of some simple expression. >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> > >> >> >> >> >> >> >> >> >Do the snort rules running on the transparent >> >> >> >> >> >> >> >> >inline >> >> >> >> >> >> >> >> >snort box >> >> >> >> >> >> >> >> >reset >> >> >> >> >> >> >> >> >the >> >> >> >> >> >> >> >> >traffic that passes through using inline? >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> Depends on if you use DROP or SDROP :).. However, >> >> >> >> >> >> >> >> inline >> >> >> >> >> >> >> >> doesn't >> >> >> >> >> >> >> >> JUST >> >> >> >> >> >> >> >> reset>> >> >> >> >> >> >> >> the traffic.. it also prevents the packet from >> >> >> >> >> >> >> >> being>> >> >> >> >> >> >> >> forwarded >> >> >> >> >> >> >> >> at >> >> >> >> >> >> >> >> all. >> >> >> >> >> >> >> >> DROP >> >> >> >> >> >> >> >> will also reset, SDROP won't. >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> Snort 2.3's inline capacity is a direct port of >> >> >> >> >> >> >> >> snort-inline. >> >> >> >> >> >> >> >> You >> >> >> >> >> >> >> >> might >> >> >> >> >> >> >> >> want to check their FAQ for other info: >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> http://snort-inline.sourceforge.net/FAQ.html >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> ------------------------------------------------------- >> >> >> >> >> >> >> >> SF email is sponsored by - The IT Product Guide >> >> >> >> >> >> >> >> Read honest & candid reviews on hundreds of IT >> >> >> >> >> >> >> >> Products >> >> >> >> >> >> >> >> from >> >> >> >> >> >> >> >> real >> >> >> >> >> >> >> >> users.>> >> >> >> >> >> >> >> Discover which products truly live up to the >> >> >> >> >> >> >> >> hype.>> >> >> >> >> >> >> >> Start >> >> >> >> >> >> >> >> reading >> >> >> >> >> >> >> >> now. >> >> >> >> >> >> >> >> http://productguide.itmanagersjournal.com/ >> >> >> >> >> >> >> >> _______________________________________________ >> >> >> >> >> >> >> >> Snort-users mailing list >> >> >> >> >> >> >> >> Snort-users () lists sourceforge net >> >> >> >> >> >> >> >> Go to this URL to change user options or >> >> >> >> >> >> >> >> unsubscribe: >> >> >> >> >> >> >> >> https://lists.sourceforge.net/lists/listinfo/snort-users >> >> >> >> >> >> >> >> Snort-users list archive: >> >> >> >> >> >> >> >> http://www.geocrawler.com/redir-sf.php3?list=snort-users >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> > >> >> >> >> >> >> >> > >> >> >> >> >> >> >> > ------------------------------------------------------- >> >> >> >> >> >> >> > SF email is sponsored by - The IT Product Guide >> >> >> >> >> >> >> > Read honest & candid reviews on hundreds of IT >> >> >> >> >> >> >> > Products >> >> >> >> >> >> >> > from real >> >> >> >> >> >> >> > users. >> >> >> >> >> >> >> > Discover which products truly live up to the hype. >> >> >> >> >> >> >> > Start >> >> >> >> >> >> >> > reading >> >> >> >> >> >> >> > now. >> >> >> >> >> >> >> > http://productguide.itmanagersjournal.com/ >> >> >> >> >> >> >> > _______________________________________________ >> >> >> >> >> >> >> > Snort-users mailing list >> >> >> >> >> >> >> > Snort-users () lists sourceforge net>> >> >> >> >> >> >> > Go to this URL to change user options or >> >> >> >> >> >> >> > unsubscribe:>> >> >> >> >> >> >> > https://lists.sourceforge.net/lists/listinfo/snort-users >> >> >> >> >> >> >> > Snort-users list archive: >> >> >> >> >> >> >> > http://www.geocrawler.com/redir-sf.php3?list=snort-users >> >> >> >> >> >> >> > >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> > >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> > >> >> >> >> >> >> >> >> >> >> >> >> >> >> > >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> Best regards, >> >> >> >> >> >> Michael D. Peters >> >> >> Director of Security Services >> >> >> CISSP >> >> >> Lazarus Alliance Inc. >> >> >> M: 502-767-3448 >> >> >> O: 502-231-8017 x8 >> >> >> H: 502-231-6923 >> >> >> F: 502-231-5347 >> >> >> >> >> >> michael.peters () lazarusalliance com >> >> >> www.lazarusalliance.com >> >> >> >> >> >> Verify here: http://wwwkeys.us.pgp.net >> >> >> >> >> >> >> >> > >> >> > >> >> > ------------------------------------------------------- >> >> > SF email is sponsored by - The IT Product Guide >> >> > Read honest & candid reviews on hundreds of IT Products from real >> >> > users. >> >> > Discover which products truly live up to the hype. Start reading >> >> > now. >> >> > http://productguide.itmanagersjournal.com/ >> >> > _______________________________________________ >> >> > Snort-users mailing list >> >> > Snort-users () lists sourceforge net >> >> > Go to this URL to change user options or unsubscribe: >> >> > https://lists.sourceforge.net/lists/listinfo/snort-users >> >> > Snort-users list archive: >> >> > http://www.geocrawler.com/redir-sf.php3?list=snort-users >> >> > >> >> >> >> >> > >> >> >
------------------------------------------------------- The SF.Net email is sponsored by: Beat the post-holiday blues Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek. It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Re: Re: Inline IP_Forwarding and other simple questions? mdpeters (Jan 02)
- <Possible follow-ups>
- Re: Re: Inline IP_Forwarding and other simple questions? mdpeters (Jan 02)
- RE: Re: Inline IP_Forwarding and other simple questions? Gould, Scott (Jan 02)
- Re: Re: Inline IP_Forwarding and other simple questions? mdpeters (Jan 04)