Snort mailing list archives
Re: send flex-resp through interface which has no ip-address!?
From: G Ramon Gomez <gene () gomezbrothers com>
Date: Wed, 30 Nov 2005 08:08:48 -0800
Hiya Elmar,I had to solve this issue yesterday. Well, maybe not solve, but I got a funky work-around going. The way I got it working was by assigning an IP that was invalid for the network to the previously IP-less interface (I essentially told the OS that the CIDR net was a little larger than it really was, then assigned an IP just outside of the legal range for that network to the interface), then adding an entry for the network's default gateway to the routing table. This isn't perfect; hosts within my "expanded" CIDR net, but that are actually remote, will never get RSTs, but it has the benefit of snort still being somewhat transparent to scans (at least remotely), and getting those RSTs where they need to go.
- Ramon Elmar Bschorer wrote:
how can i manage, that snort sends felxible resps through e.g. eth0 which has no ip-address assigned!?
------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- send flex-resp through interface which has no ip-address!? Elmar Bschorer (Nov 24)
- RE: send flex-resp through interface which has no ip-address!? Paul Melson (Nov 28)
- Re: send flex-resp through interface which has no ip-address!? Jeff Nathan (Nov 30)
- Re: send flex-resp through interface which has no ip-address!? G Ramon Gomez (Nov 30)
- RE: send flex-resp through interface which has no ip-address!? Paul Melson (Nov 28)