Snort mailing list archives
snort 2.8.4 and inline mode
From: justin joseph <justinjoseph007 () gmail com>
Date: Tue, 25 Aug 2009 18:22:25 +0530
Hi I have compiled from source snort 2.8.4 with --enable-inline support. to get rules for inline mode I have downloaded ruleset using oinkmaster with the below config file: url = http://www.snort.org/pub-bin/oinkmaster.cgi/006d6ba065a1c0fe55e6e4a25d74518236a3da19/snortrules-snapshot-2.8.tar.gz path = /bin:/usr/bin:/usr/local/bin update_files = \.rules$|\.config$|\.conf$|\.txt$|\.map$ skipfile local.rules skipfile deleted.rules skipfile snort.conf modifysid * "^alert" | "drop" As I understand the modifysid converts all the alert rules to drop rules. I am running this with the default config file in the etc/snort.conf file by changing only the paths to rules and library directories. When I test this setup with IDSwakeup-1.0, I don't see any drop of packets happening. I know this because i have commented code in inline.c with debug prints against drop and accept verdicts. Also there are no alerts in the logs. But if I ran the same setup with the same config (snort.conf) file without the -Q option in IDS mode with only difference in using rules with alert rules(downloaded with oinkmaster without modifysid) I see that there are lot of alerts when tested with IDSwakeup-1.0. What I am doing wrong, why isn't the inline mode dropping packets that are being alerted in the IDS mode? is there any configuration changes required in snort.conf between inline and IDS modes? thank you Justin ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- snort 2.8.4 and inline mode justin joseph (Aug 25)
- Re: snort 2.8.4 and inline mode Will Metcalf (Aug 25)
- Re: snort 2.8.4 and inline mode justin joseph (Aug 25)
- Re: snort 2.8.4 and inline mode Will Metcalf (Aug 25)