Snort mailing list archives
drop a packet from a preprocessor
From: David Cann <dlcann () engmail uwaterloo ca>
Date: Fri, 28 Apr 2006 18:49:51 -0400
If I wanted to write a preprocessor to do nothing but drop a packet of type ICMP, is the following code correct?
if ( p->iph->ip_proto == 1 ) { InlineDrop(); }Is this correct? I'm running snort in Inline-mode, but this InlineDrop() command doesn't seem to kill the packet. Ideally I want to send a "reject" command back to iptables, but "drop" would also be sufficient.
Note, I have all the regular preprocessor boilerplate code, all I need to figure out is this one bit
Thanks, --D ------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- drop a packet from a preprocessor David Cann (Apr 28)