Snort mailing list archives
RE: Country blocking?
From: Cilin <cilin5 () yahoo com>
Date: Tue, 18 Jan 2005 13:28:05 -0800 (PST)
You can check out the Ip-to-country database at http://ip-to-country.webhosting.info. It isn't perfect but at least there is the hope of update in the near future. If you use it to preemptively block IPs, then you should consider the chance of blocking someone on accident. But this is a risk you take with any non-perfect database. I tried searching for a free and complete mapping but couldn't find one. If anyone knows of a flawless free/paid database please let me know. -Vents --- "Donofrio, Lewis" <donofrio () umich edu> wrote:
Anything from RIPE.NET could be blocked as far as I can tell.... --just my 2 cents.
______________________________________________________________________
Lewis Donofrio () umich edu College of Literature, Science, & Arts 1007 East Huron, Room 201, BetaID:243340 Cell: (734) 323-8776 Ann Arbor,MI 48104-1690 www.umich.edu/~donofrio Fax: (734) 647-8333
----------------------------------------------------------------------
() ascii ribbon campaign - against html mail /\ [http://arc.pasp.de/] -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Alex Kirk Sent: Tuesday, January 18, 2005 8:56 AM To: mdpeters Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] Country blocking? That's probably a task that's better suited for your firewall, if you're just dropping all connections from a country, irrespective of what they contain. That being said, though, it can be difficult to block based on geographic region, let alone a specific country. IP address ranges are somewhat fluid, and geolocation is still an inexact science. Unless I'm unaware of some new technology out there, chances are good that your attempt to block by country will result in some connections from it still getting through, along with the blocking of some things that aren't from that country -- especially since there's nothing in most packets that associate them with a specific country. I mean, it's not like you could to try to use Snort to block anything that contained the Chinese character set, since you'd miss messages coming from China in English, but zap messages in Chinese from, say, Cambodia, Vietnam, or even America. It gets worse when dealing with straight TCP/IP -- you wouldn't even have that kind of a clue. If anyone else has a solution to this, I'm all ears, but I have a feeling you're out of luck here. Alex Kirk Research Analyst Sourcefire, Inc.Could anyone advise me on how to block a large IPaddress space usingSnort-inline? For example, I would like to dropall connectionsoriginating from China.
-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek. It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek. It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
===== Fair-weather friends are no friends at all. If you have done something that some people find distasteful then expect them to tell you so. A true friend will let you know how they feel but respect your right to choose, while a fair-weather friend will judge you by your actions and leave. "Knowing others is wisdom, knowing yourself is Enlightenment." -Lao Tzu __________________________________ Do you Yahoo!? Yahoo! Mail - You care about security. So do we. http://promotions.yahoo.com/new_mail ------------------------------------------------------- The SF.Net email is sponsored by: Beat the post-holiday blues Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek. It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Country blocking? mdpeters (Jan 19)
- Re: Country blocking? Alex Kirk (Jan 19)
- Re: Country blocking? Jose Maria Lopez (Jan 19)
- <Possible follow-ups>
- RE: Country blocking? Donofrio, Lewis (Jan 19)
- RE: Country blocking? Cilin (Jan 19)
- Message not available
- RE: Country blocking? Matt Kettler (Jan 19)
- RE: Country blocking? Theodore Stout (Jan 19)
- Re: Country blocking? D.P.Round (Jan 19)
- Re: Country blocking? Wally Bedford (Jan 19)
- Re: Country blocking? Alex Butcher, ISC/ISYS (Jan 19)
- Re: Country blocking? Jose Maria Lopez (Jan 19)