Fwd: Raw IP packet filter rule

[Leon Ward <seclists () rm-rf co uk>]

Forgot to CC list...


Begin forwarded message:

> From: Leon Ward <seclists () rm-rf co uk>
> Date: 19 January 2009 09:59:05 GMT
> To: Ian Masters <ian () acces co jp>
> Subject: Re: [Snort-users] Raw IP packet filter rule
>
> Assuming you want to prevent local (trusted) IP's from triggering a  
> port scan, you probably want to use either:
>
> - ignore_scanners (read README.sfportscan)
> - suppression (take a look at READE.thresholding)
>
> Both readme files can be found in the snort tarball.
>
> -Leon
>
> On 19 Jan 2009, at 00:44, Ian Masters wrote:
>
> > Hi
> >
> > I'd like to set up some pass rules for local "port scan", which  
> > actually
> > isn't.
> >
> > I know that pass rules accept tcp, udp, icmp and ip values, but am I
> > right in thinking that using 'ip' will pass tcp, udp and icmp  
> > packets too?
> >
> > How can I pass just these 'raw ip' packets?
> >
> > Thanks
> >
> > Ian
> >
> >
> > ------------------------------------------------------------------------------
> > This SF.net email is sponsored by:
> > SourcForge Community
> > SourceForge wants to tell your story.
> > http://p.sf.net/sfu/sf-spreadtheword
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users

------------------------------------------------------------------------------
This SF.net email is sponsored by:
SourcForge Community
SourceForge wants to tell your story.
http://p.sf.net/sfu/sf-spreadtheword

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users