Snort mailing list archives
Re: Fwd: snort with nfququ
From: "Chinmay Mahata" <chinmay_mahata () rediffmail com>
Date: 14 May 2013 13:13:29 -0000
Hi, For using NFQ in snort you need to use following arguments to run snort: -Q -c ${CONF} --daq nfq --daq-var queue=${NFQ_NUM} --daq-var queue_len=${NFQ_LEN} --daq-var device=${NFQ_DEV} And then put iptables rules in your INPUT, OUTPUT and FORWARD chains of filter table, like - iptables -t filter -A ${CHAIN_NAME} -j NFQUEUE --queue-num ${NFQ_NUM} Hope you got it. Cheers, --Chinmay From: Meysam Farazmand <farazmand.meisam () gmail com> Sent: Thu, 09 May 2013 21:54:44 To: snort-users () lists sourceforge net Subject: [Snort-users] Fwd: snort with nfququ Hello, i want to run Snort as IPS with NFQUEUE. i have installed libnetfilter_queue and loaded it in snort. Now i wanted to know which iptables command do i have to issue to give traffic from kernel to Snort? Regards ------------------------------------------------------------------------------ Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive new guide to graph databases and their applications. This 200-page book is written by three acclaimed leaders in the field. The early access version is available now. Download your free book today! http://p.sf.net/sfu/neotech_d2d_may _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
------------------------------------------------------------------------------ AlienVault Unified Security Management (USM) platform delivers complete security visibility with the essential security capabilities. Easily and efficiently configure, manage, and operate all of your security controls from a single console and one unified framework. Download a free trial. http://p.sf.net/sfu/alienvault_d2d
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Fwd: snort with nfququ Meysam Farazmand (May 09)
- <Possible follow-ups>
- Re: Fwd: snort with nfququ Chinmay Mahata (May 14)