Re: snort and squid

[Joel Esler <joel.esler () sourcefire com>]

Of course Snort will inspect the traffic.  However, to view the  
internal ip, if the proxy is rewriting the Source IP, then it's a  
limitation.

If your intention is other, please clarify.  I'm afraid I am not sure  
I understand what you are asking then.

Joel

On Jan 18, 2008, at 4:26 AM, Helmut Schneider wrote:

> From: "Joel Esler" <joel.esler () sourcefire com>
>
> > You have two options.  Correlate the events with the logs from  
> > your  Squid
> > proxy, or move the Snort sensor inside the proxy.
>
> The second sensor *is* on the proxy.
>
> > Sometimes (and right now I can't remember if Squid does it) it  
> > will  add a
> > header to the http that says "X-Forwarded-For" or similar that
>
> X-Forwared-For is disabled of course. :)
>
> > will have the IP of the actual client.  However, like I said, I can't
> > remember if Squid does that for you, and that would be the only  
> > way  that
> > you can see the IP behind the proxy.
>
> So, snort (or the current ruleset) is not able to inspect certain  
> squid
> traffic? As I replied to Paul, some things are caught (e.g.  
> SHELLCODE x86
> NOOP, Invalid FTP Command, and some more) but not the policy or porn
> traffic.
>
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users