Snort mailing list archives
snort inline mode in FreeBSD and IPFW
From: Nomad Esst <noname.esst () yahoo com>
Date: Wed, 3 Jul 2013 04:35:39 -0700 (PDT)
Hi list I'm trying to run snort in inline mode in FreeBSD and IPFW as DAQ. But it does not drop packets. Here's my configurations: Here is my custom snort.conf: (named snr.conf) config daq: ipfw config daq_mode: inline config policy_mode: inline output alert_full: stdout include snort.rule Here is a simple rule file: (name snort.rule) drop tcp any any -> any 23 (msg: "Drop telnet packets"; sid: 1000001) pass ip any any -> any any And here is what I do: snort -c /root/snr.conf -Q --alert-before-pass And I expect the ICMP packets to pass and telnet packets to drop. But both packet types pass! Am I missing something? Or snort is buggy in FreeBSD and inline mode?
------------------------------------------------------------------------------ This SF.net email is sponsored by Windows: Build for Windows Store. http://p.sf.net/sfu/windows-dev2dev
_______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel Archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- snort inline mode in FreeBSD and IPFW Nomad Esst (Jul 03)