Snort mailing list archives
Re: Homebrew Snort Reactive/Unified2 output
From: Korodev <korodev () gmail com>
Date: Thu, 31 Mar 2011 09:11:51 -0500
At the risk of getting into a pilosophical discussion... The absolute fastest place to fire a response post-detection would be an output plugin. There's no need to hook the U2 output plugin or write an output module for BY2, depending on a number of factors you're not going to get the absolute fastest activation time for your code from the point of detection.
That seems to be the general consensus. To avoid the philosophical discussion, I'm not only interested in IPS style responses, but simply interested in getting a 'heartbeat' signal as soon as an alert has tripped. My only reason for implying hooking the U2 output plugin, was my desire to preserve U2 output for later processing. I feel like I'm being directed away from that, but not sure why (?) I haven't played with Snort's output plugins in the past, so this will be a beneficial exercise. \\korodev ------------------------------------------------------------------------------ Create and publish websites with WebMatrix Use the most popular FREE web apps or write code yourself; WebMatrix provides all the features you need to develop and publish your website. http://p.sf.net/sfu/ms-webmatrix-sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Re: Homebrew Snort Reactive/Unified2 output, (continued)
- Re: Homebrew Snort Reactive/Unified2 output Jefferson, Shawn (Mar 30)
- Re: Homebrew Snort Reactive/Unified2 output Russ Combs (Mar 30)
- Re: Homebrew Snort Reactive/Unified2 output Korodev (Mar 30)
- Re: Homebrew Snort Reactive/Unified2 output Martin Holste (Mar 30)
- Re: Homebrew Snort Reactive/Unified2 output Korodev (Mar 30)
- Re: Homebrew Snort Reactive/Unified2 output beenph (Mar 30)
- Re: Homebrew Snort Reactive/Unified2 output Martin Holste (Mar 31)
- Re: Homebrew Snort Reactive/Unified2 output Russ Combs (Mar 30)
- Re: Homebrew Snort Reactive/Unified2 output waldo kitty (Mar 30)
- Re: Homebrew Snort Reactive/Unified2 output Jefferson, Shawn (Mar 30)
- Re: Homebrew Snort Reactive/Unified2 output Korodev (Mar 31)
- Re: Homebrew Snort Reactive/Unified2 output Martin Roesch (Mar 31)