Re: A question now that I have nfq working

[Graham Murray <graham () gmurray org uk>]

James Lay <jlay () slave-tothe-box net> writes:

> Well this has been an interesting exercise. Basically it boils down to
> this: either a packet in the Snort nfqueue is accepted and sent on, or
> it's dropped. Now dropped is self evident, but "accepted and sent on"
> means exactly that...sent up the stack, NOT to the next rule in the
> table..the packet is treated just like it had hit an iptables ACCEPT
> rule.

Maybe the solution to that would be to put the NFQ in the mangle table
PREROUTING chain rather than the filter table INPUT chain. That way if
snort accepted (via a verdict of NF_ACCEPT) the packet would traverse
the 'normal' filter rules.

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/NeoTech
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!