Re: send flex-resp through interface which has no ip-address!?

[Jeff Nathan <jeff () snort org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Nov 28, 2005, at 11:15 AM, Paul Melson wrote:

> -----Original Message-----
> Subject: [Snort-users] send flex-resp through interface which has no
> ip-address!?
>
> > how can i manage, that snort sends felxible resps through e.g.  
> > eth0 which
> has no ip-address > assigned!?
>
>
> It is not necessary for the interface to be addressed as flexresp  
> will spoof
> the source and destination address of the FIN or host-unreachable  
> packets it
> is sending to match the connection it is trying to shut down.  This  
> should
> work with minimal configuration unless for some reason you cannot send
> packets to the network port that Snort is listening on (which would  
> be a
> switch/tap issue, not a Snort issue).
>
> PaulM


That's incorrect.  The old flexresp code uses a raw socket, which  
makes use of the routing table on any host performing active  
response.  In other words, it can't use an interface without an IP  
address.

- -Jeff

> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through  
> log files
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD  
> SPLUNK!
> http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


- --
Now with 100% more mailing lists.
http://nemesis.sourceforge.net


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFDjcr1Eqr8+Gkj0/0RAmflAKC4tJkcswo3aWTZFVXgj0xOuqdq6wCfTNz7
lLcEwXpLjCUyesxnK/1Pat0=
=hYpv
-----END PGP SIGNATURE-----


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users