RE: [Snort-users] Packet drop functionality with snort

Title: RE: [Snort-users] Packet drop functionality with snort

That is does. I use it and love it. Two things to point out though:

1) The offending packet makes it through. There isn't any kind of a 'drop'. Its rather like your girlfriend's dad listening in on your phone calls. All he can do at the time is make you hang up...

2) You can find yourself in a loop when snort sends a reset which triggers a rule which sends a reset which triggers a rule which sends a reset which triggers a rule which sends a reset, etc. This will basically fill your logs in less than a second. If it were a 'drop', we wouldn't really have to deal with this condition. So, as always, test your ruleset.

-----Original Message-----
From: snort-users-admin@lists.sourceforge.net [mailto:snort-users-admin@lists.sourceforge.net]On Behalf Of L. Christopher Luther
Sent: Tuesday, March 11, 2003 10:43 AM
To: 'rajat khatri'
Cc: Snort-Users (E-mail)
Subject: RE: [Snort-users] Packet drop functionality with snort

One work: flexresp. I've not used this functionality but I understand that it will allow Snort to send RST packets (or something like this) to an offending IP.

- Christopher

-----Original Message-----
From: rajat khatri [mailto:rajat_40@yahoo.com.hk]
Sent: Tuesday, March 11, 2003 10:58 AM
To: snort-users@lists.sourceforge.net
Subject: [Snort-users] Packet drop functionality with snort

hi all ,

I am using snort for the purpose it is meant to
serve(IDS) .I would like to know how can snort be
configured
or used to drop packets .
My setup comprises of 5 machines connected via a hub,
with snort installed on one of the boxes.
I am running low on time and would like to add this
vital functionality most definitely ,so any ideas ,
comments on the same idea would be most appreciated.

regards,
rajat

_______________________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com.hk address at http://mail.english.yahoo.com.hk

-------------------------------------------------------
This SF.net email is sponsored by:Crypto Challenge is now open!
Get cracking and register here for some mind boggling fun and
the chance of winning an Apple iPod:
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0031en
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users