Snort mailing list archives
Re: icmp pass rules
From: "Stephen Reese" <rsreese () gmail com>
Date: Fri, 24 Oct 2008 13:21:29 -0400
So if I plan on filtering a host or subnet then use suppression otherwise stick to pass? I'm trying to keep in mind down the road after the pass/suppression rules start building up there will be performance implications so I'm trying to start off smart so I don't have to go through and rewrite a bunch of rules... On Fri, Oct 24, 2008 at 12:59 PM, Frank Knobbe <frank () knobbe us> wrote:
On Fri, 2008-10-24 at 09:14 -0400, Stephen Reese wrote:The real question is why do pass rules even exist if you could use suppression instead and not have the performance penalty.Because you can be way more specific with pass rules (icode, dsize, content, etc) whereas with suppressions, you can only filter by *one* IP address and SID. -Frank -- It is said that the Internet is a public utility. As such, it is best compared to a sewer. A big, fat pipe with a bunch of crap sloshing against your ports.
------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Re: icmp pass rules, (continued)
- Re: icmp pass rules John Gay (Oct 24)
- Message not available
- Re: icmp pass rules Stephen Reese (Oct 24)
- Re: icmp pass rules Joel Esler (Oct 24)
- Re: icmp pass rules Stephen Reese (Oct 24)
- Message not available
- Re: icmp pass rules Stephen Reese (Oct 24)
- Re: icmp pass rules Stephen Reese (Oct 24)
- Message not available
- Re: icmp pass rules Stephen Reese (Oct 27)
- Message not available
- Re: icmp pass rules Stephen Reese (Oct 28)
- Re: icmp pass rules Frank Knobbe (Oct 24)
- Re: icmp pass rules Frank Knobbe (Oct 24)
- Re: icmp pass rules Stephen Reese (Oct 24)
- Re: icmp pass rules Frank Knobbe (Oct 24)
- Re: icmp pass rules Stephen Reese (Oct 24)