[Snort-users] snort-inline

From: Ales Stibal <astib(at)giganet.cz>
Date: Tue Mar 18 2003 - 11:10:27 EST

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello list,
I have big problem to run snort-inline on single host. I wanted my box to be protected by snort-inline, but I failed to do so. I tried to run various kernels, only one that seems to allow snort do it's job
on QUEUE is vanilla 2.4.20 ( recently I tried same versions, but gentoo patches,
including P-O-M of netfilter)

I am running iptables commands:

iptables -A INPUT -d $ETH0_IP -m state --state ESTABLISHED,RELATED -j QUEUE //FIXME: the line bellow seems obsolete to me ... (unreachable) iptables -A INPUT -d $ETH0_IP -m state --state ESTABLISHED,RELATED -j ACCEPT

With this rule packet successfully fall to QUEUE, is detected by snort_inline
(it's shown when using -v flag), but nothing is passed trough.

Any help is more than welcomed, I am running out of new ideas.

Thanx in advance!

        RIP,                 Astib();
- --
A l e s S t i b a l, Wintel free, powered by AthlonXP and Gentoo Linux. <astib@giganet.cz> Giganet.cz community network, Litomerice, Czech Republic
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iQEVAwUBPndE8kWf4FKnBsR/AQLMhwf9ELNIudcau04VE/6USrnKhw2Z9rvXNeag ekv8R3XbCPWRWjJnfL7QhP9ZjahvtQdTQEdfHjNlcPpKSKtPnaBLj8fOvTWAcuRe D5MrlZzUxAdR6iuyn1QHDMomqlM16XUU9a2xzWplHvnyjSKwgfaUdM15XH4/7xJr 18tOp8ktCTaMaOureGcfmLggoMQwfVECVrR5BZ+NT4nFVewSXc8ewIPQ8Q1lAu4p 9LjEMosdy4cOPcktZnlMiOC4PbtUOwu7Vp4mRR/4Zo4DvZxZIHnexiQBS4n1xkzc 48O715KCgJ24LDtYctKfUVqzkrk2JpSMBh84FCs/Zo/ZEz2wxVfOLw== =c7Uy
-----END PGP SIGNATURE-----

---

This SF.net email is sponsored by: Does your code think in ink? You could win a Tablet PC. Get a free Tablet PC hat just for playing. What are you waiting for?
http://ads.sourceforge.net/cgi-bin/redirect.pl?micr5043en

---

Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users Received on Tue Mar 18 11:37:54 2003