Re: Snort-Inline and worm containment

On 28 Jan 2003, Tom McLaughlin wrote:

> The recent Slammer worm made me think a little about using Snort-Inline

The Honeynet Project has been doing some playing with this. What can potentially block this type of inbound (or outbound) activity is not only the matching rule, but the scanning. The portscan preprocessor can detect scanning activity. If a worm were to meet this criteria, the portscan preprocessor can be used to block it. We already tested this with the fnord preprocessor.

As I said, we are just in the initial testing of using not only rules, but preprocessors for blocking malicious activity.

lance Received on Fri Jan 31 11:24:51 2003