Re: inline mode works(seems) without compiling with --enable-inline option

[Russ Combs <rcombs () sourcefire com>]

Hey Justin,

Thanks for the patch.  The -Q option, and the inline implementation in
general, is a little confusing.  However, there is no warning without
--enable-inline because it allows Snort to be deployed inline using 3rd
party pcap implementations that don't require ipq or ipfw.

Compounding that, the help for -Q is only output for ipq builds.  The help
will be addressed in an upcoming release.

Russ

On Wed, Aug 5, 2009 at 8:11 AM, justin joseph <justinjoseph007 () gmail com>wrote:

> Hi
>
> Were trying to configure snort-inline on Ubuntu hardy (snort version
> 2.7.0) for some days.
> Today figured out by looking at the code that even if snort was not
> compiled with --enable-inline
> option, it was seemingly running with the -Q option(drop, sdrop,
> reject won't work off course)
>
> IMHO this confuses a newbie user like me because if snort was not
> compiled enabling
> inline mode then it is supposed to print error and abort if user tries
> to run with the -Q option.
>
> Attached patch against 2.8.4(changes in snort.c) or something like
> that would be nice IMHO.
>
> thank you
> Justin
>
>
> ------------------------------------------------------------------------------
> Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
> trial. Simplify your report design, integration and deployment - and focus
> on
> what you do best, core application coding. Discover what's new with
> Crystal Reports now.  http://p.sf.net/sfu/bobj-july
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users<https://lists.sourceforge.net/lists/listinfo/snort-users%0ASnort-users>list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day 
trial. Simplify your report design, integration and deployment - and focus on 
what you do best, core application coding. Discover what's new with 
Crystal Reports now.  http://p.sf.net/sfu/bobj-july

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users