Snort mailing list archives
RE: Slow down TCP connections
From: "pfeito" <pfeito () netcabo pt>
Date: Sun, 29 Aug 2004 20:13:54 +0100
I don't really have a final purpose, I'm just digging out what proactive stuff there is out there for Snort. I don't need it, I just thought of it, as an example of proactive functionality and wanted to find out if there is such thing. I guess it is kind of stupid.... although it could be useful in an snort+honeypot scenario. Don't really put much though in it.
Why are you seeking and IDS to do traffic queueing ?
No. That would be like trying to cut a steak with a spoon :P !
-----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users- admin () lists sourceforge net] On Behalf Of Keith W. McCammon Sent: domingo, 29 de Agosto de 2004 18:14 To: snort-users () lists sourceforge net Subject: Re: [Snort-users] Slow down TCP connectionsRight know, I've just compiled and installed snort 2.2.0 with flexresp2 support. I'm about to test flexresp2 capabilities, but It seems to havenosupport for slowing down TCP connections (i.e. for slowing down TCPScansfor instance...)Why would Snort want to "slow down" a TCP scan? Snort will catch it, and under certain circumstances, flexresp2 can reset those connections. That's pretty much the extent of Snort's involvement.Do you know any plug-in that allows Snort to slow down TCP connectionsspeed(i.e. resize TCP window size) ?No. What would you accomplish by doing this? Either block the traffic or don't. Slowing it down won't really get you anywhere (it'll just take the attacker longer to do the same thing). ------------------------------------------------------- This SF.Net email is sponsored by BEA Weblogic Workshop FREE Java Enterprise J2EE developer tools! Get your free copy of BEA WebLogic Workshop 8.1 today. http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- This SF.Net email is sponsored by BEA Weblogic Workshop FREE Java Enterprise J2EE developer tools! Get your free copy of BEA WebLogic Workshop 8.1 today. http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- thanks guys! Jeremy Kocimski (Aug 29)
- Slow down TCP connections pfeito (Aug 29)
- Re: Slow down TCP connections Keith W. McCammon (Aug 29)
- RE: Slow down TCP connections pfeito (Aug 29)
- Re: Slow down TCP connections Jeff Nathan (Aug 29)
- Re: Slow down TCP connections James Edwards (Aug 29)
- RE: Slow down TCP connections Jim Hendrick (Aug 29)
- RE: Slow down TCP connections pfeito (Aug 29)
- Re: Slow down TCP connections Jose Maria Lopez (Aug 31)
- Re: Slow down TCP connections Keith W. McCammon (Aug 29)
- Slow down TCP connections pfeito (Aug 29)